{"id":92913,"date":"2020-09-01T13:42:56","date_gmt":"2020-09-01T11:42:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting"},"modified":"2020-09-01T13:42:56","modified_gmt":"2020-09-01T11:42:56","slug":"5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","title":{"rendered":"5. Check Point SandBlast Agent Management Platform. Napl\u00f3k, Jelent\u00e9sek & Nyomoz\u00e1s. Fenyeget\u00e9svad\u00e1szat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"5.
\n
\n\u00dcdv\u00f6z\u00f6lj\u00fck az \u00f6t\u00f6dik cikk\u00e9ben a Check Point SandBlast Agent Management Platform megold\u00e1s\u00e1r\u00f3l sz\u00f3l\u00f3 ciklusnak. Az el\u0151z\u0151 cikkek megtekint\u00e9s\u00e9hez k\u00e9rj\u00fck, l\u00e1togasson el a megfelel\u0151 linkre: az els\u0151<\/a><\/noindex>, m\u00e1sodik<\/a><\/noindex>, harmadik<\/a><\/noindex>, a negyedik<\/a><\/noindex>. Ma a Management Platform monitoroz\u00e1si lehet\u0151s\u00e9geit vizsg\u00e1ljuk, k\u00fcl\u00f6n\u00f6s figyelmet ford\u00edtva a napl\u00f3kra, interakt\u00edv ir\u00e1ny\u00edt\u00f3pultokra (View) \u00e9s a jelent\u00e9sekre. Emellett besz\u00e9lni fogunk a Threat Hunting t\u00e9m\u00e1j\u00e1r\u00f3l a felhaszn\u00e1l\u00f3i g\u00e9pen l\u00e9v\u0151 aktu\u00e1lis fenyeget\u00e9sek \u00e9s anom\u00e1li\u00e1k azonos\u00edt\u00e1s\u00e1hoz.
\n<\/a><\/noindex><\/p>\n

Napl\u00f3f\u00e1jlok<\/h2>\n

\nA biztons\u00e1gi esem\u00e9nyek monitoroz\u00e1s\u00e1nak f\u0151 inform\u00e1ci\u00f3forr\u00e1sa a Logs r\u00e9sz, amely r\u00e9szletes t\u00e1j\u00e9koztat\u00e1st ny\u00fajt minden egyes incidensr\u0151l, \u00e9s k\u00e9nyelmes sz\u0171r\u0151ket is biztos\u00edt a keres\u00e9si krit\u00e9riumok pontosabb be\u00e1ll\u00edt\u00e1s\u00e1hoz. P\u00e9ld\u00e1ul, amikor a jobb gombbal r\u00e1kattint egy log param\u00e9terre (Blade, Action, Severity stb.), ez a param\u00e9ter \u00fagy sz\u0171rhet\u0151, hogy Filter: \u201eParameter\u201d<\/i> vagy Filter Out: \u201eParameter\u201d<\/i>. A Source param\u00e9ter eset\u00e9ben IP Tools opci\u00f3 is v\u00e1laszthat\u00f3, amely lehet\u0151v\u00e9 teszi pingen kereszt\u00fcl ellen\u0151rizni a megadott IP-c\u00edmet\/n\u00e9v, vagy nslookup v\u00e9grehajt\u00e1s\u00e1ra az IP-c\u00edm forr\u00e1s\u00e1nak lek\u00e9r\u00e9s\u00e9hez neve alapj\u00e1n.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

A Logs r\u00e9szben az esem\u00e9nyek sz\u0171r\u00e9s\u00e9re Statistics almappa tal\u00e1lhat\u00f3, amely minden param\u00e9terre vonatkoz\u00f3 statisztik\u00e1t mutat: id\u0151diagram a napl\u00f3k sz\u00e1m\u00e1val, valamint sz\u00e1zal\u00e9kos ar\u00e1nyok az egyes param\u00e9terek eset\u00e9ben. Ebb\u0151l az almapp\u00e1b\u00f3l a napl\u00f3k k\u00f6nnyen sz\u0171rhet\u0151ek an\u00e9lk\u00fcl, hogy keres\u0151s\u00e1vra lenne sz\u00fcks\u00e9g, \u00e9s kifejez\u00e9seket kellene \u00edrni \u2014 elegend\u0151 kiv\u00e1lasztani a k\u00edv\u00e1nt param\u00e9tereket, \u00e9s az \u00faj napl\u00f3lista azonnal megjelenik.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

A r\u00e9szletes inform\u00e1ci\u00f3k minden logr\u00f3l el\u00e9rhet\u0151k a Logs szekci\u00f3 jobb panelj\u00e9n, azonban k\u00e9nyelmesebb a log tartalm\u00e1nak elemz\u00e9s\u00e9hez, ha dupl\u00e1n r\u00e1kattintunk. Az al\u00e1bbiakban bemutatunk egy log p\u00e9ld\u00e1t (k\u00e9p kattinthat\u00f3), amelyben r\u00e9szletes inform\u00e1ci\u00f3k tal\u00e1lhat\u00f3k a Threat Emulation v\u00e9delem \u00e1ltal v\u00e9grehajtott Prevent m\u0171velet egy fert\u0151z\u00f6tt ".docx" f\u00e1jlon t\u00f6rt\u00e9n\u0151 aktiv\u00e1l\u00e1s\u00e1r\u00f3l. A log t\u00f6bb alfejezetet tartalmaz, amelyek a biztons\u00e1gi esem\u00e9ny r\u00e9szleteit mutatj\u00e1k be: a m\u0171k\u00f6d\u00e9sbe l\u00e9p\u0151 politika \u00e9s v\u00e9delem, a forenzikai r\u00e9szletek, valamint a kliens \u00e9s a forgalom inform\u00e1ci\u00f3i. K\u00fcl\u00f6n figyelmet \u00e9rdemelnek a logb\u00f3l el\u00e9rhet\u0151 jelent\u00e9sek \u2013 Threat Emulation Report \u00e9s Forensics Report. Ezeket a jelent\u00e9seket a SandBlast Agent kliensb\u0151l is megnyithatjuk.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Threat Emulation Report<\/h3>\n

\n\"5.<\/a><\/noindex><\/p>\n

A Threat Emulation blade haszn\u00e1latakor, miut\u00e1n az emul\u00e1ci\u00f3t v\u00e9grehajtott\u00e1k a Check Point felh\u0151j\u00e9ben, a megfelel\u0151 napl\u00f3ban megjelenik egy hivatkoz\u00e1s a r\u00e9szletes emul\u00e1ci\u00f3s jelent\u00e9sre \u2013 Threat Emulation Report. Ennek a jelent\u00e9snek a tartalm\u00e1t r\u00e9szletesen t\u00e1rgyaljuk cikk\u00fcnkben a Check Point SandBlast Network \u00e1ltal v\u00e9gzett k\u00e1rtev\u0151elemz\u00e9sr\u0151l.<\/a><\/noindex>\u00c9rdemes megjegyezni, hogy ez a jelent\u00e9s interakt\u00edv, \u00e9s lehet\u0151s\u00e9get biztos\u00edt arra, hogy \u201em\u00e9lyebbre\u201d mer\u00fclj\u00fcnk a r\u00e9szletekben minden egyes szakaszhoz. Emellett van lehet\u0151s\u00e9g a virtu\u00e1lis g\u00e9pen v\u00e9grehajtott emul\u00e1ci\u00f3 folyamat\u00e1nak megtekint\u00e9s\u00e9re, az eredeti k\u00e1rtev\u0151 f\u00e1jl let\u00f6lt\u00e9s\u00e9re vagy a hash megszerz\u00e9s\u00e9re, valamint a Check Point Incident Response Teamhez val\u00f3 fordul\u00e1sra.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Forensics Report<\/h3>\n

\nSzinte minden biztons\u00e1gi esem\u00e9ny eset\u00e9n gener\u00e1l\u00f3dik egy Forensics Report, amely r\u00e9szletes inform\u00e1ci\u00f3kat tartalmaz a k\u00e1rtev\u0151 f\u00e1jlr\u00f3l: annak jellemz\u0151it, tev\u00e9kenys\u00e9geit, a rendszerbe val\u00f3 behatol\u00e1s pontj\u00e1t \u00e9s a c\u00e9g fontos eszk\u00f6zeire gyakorolt hat\u00e1s\u00e1t. A jelent\u00e9s fel\u00e9p\u00edt\u00e9s\u00e9t r\u00e9szletesen t\u00e1rgyaltuk cikk\u00fcnkben a Check Point SandBlast Agent \u00e1ltal v\u00e9gzett k\u00e1rtev\u0151elemz\u00e9sr\u0151l.<\/a><\/noindex>Ez a jelent\u00e9s fontos inform\u00e1ci\u00f3forr\u00e1st jelent a biztons\u00e1gi esem\u00e9nyek nyomoz\u00e1sakor, \u00e9s sz\u00fcks\u00e9g eset\u00e9n azonnal elk\u00fcldhet\u0151 a jelent\u00e9s tartalma a Check Point Incident Response Teamhez.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

SmartView<\/h2>\n

\nA Check Point SmartView egy k\u00e9nyelmes eszk\u00f6z dinamikus ir\u00e1ny\u00edt\u00f3pultok (View) \u00e9s PDF form\u00e1tum\u00fa jelent\u00e9sek k\u00e9sz\u00edt\u00e9s\u00e9re \u00e9s megtekint\u00e9s\u00e9re. A SmartView-b\u00f3l az adminisztr\u00e1torok a felhaszn\u00e1l\u00f3i napl\u00f3kat \u00e9s audit esem\u00e9nyeket is megtekinthetik. Az al\u00e1bbi \u00e1br\u00e1n a SandBlast Agenttel val\u00f3 munk\u00e1hoz legjobban haszn\u00e1lt jelent\u00e9sek \u00e9s ir\u00e1ny\u00edt\u00f3pultok l\u00e1that\u00f3k.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

A SmartView jelent\u00e9sek statisztikai inform\u00e1ci\u00f3kat tartalmaznak az esem\u00e9nyekr\u0151l egy adott id\u0151szakon bel\u00fcl. A jelent\u00e9sek PDF form\u00e1tumban export\u00e1lhat\u00f3k arra a g\u00e9pre, ahol a SmartView nyitva van, \u00e9s rendszeres PDF\/Excel export is v\u00e9gezhet\u0151 az adminisztr\u00e1tor elektronikus levelez\u00e9s\u00e9re. Ezen k\u00edv\u00fcl t\u00e1mogatja a jelent\u00e9smint\u00e1k import\u00e1l\u00e1s\u00e1t\/export\u00e1l\u00e1s\u00e1t, a saj\u00e1t jelent\u00e9sek k\u00e9sz\u00edt\u00e9s\u00e9t \u00e9s a felhaszn\u00e1l\u00f3nevek elrejt\u00e9s\u00e9nek lehet\u0151s\u00e9g\u00e9t a jelent\u00e9sekben. Az al\u00e1bbi \u00e1br\u00e1n egy be\u00e9p\u00edtett Threat Prevention jelent\u00e9s p\u00e9ld\u00e1j\u00e1t l\u00e1thatjuk.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

A SmartView-ban a Dashboards (N\u00e9zet) lehet\u0151v\u00e9 teszi az adminisztr\u00e1tor sz\u00e1m\u00e1ra, hogy hozz\u00e1f\u00e9rjen a megfelel\u0151 esem\u00e9ny logjaihoz - elegend\u0151 k\u00e9tszer r\u00e1kattintani az \u00e9rdekl\u0151d\u00e9si objektumra, legyen az a diagram oszlopa vagy a k\u00e1rtev\u0151 f\u00e1jl neve. Az jelent\u00e9sekhez hasonl\u00f3an testre szabott ir\u00e1ny\u00edt\u00f3pultokat is l\u00e9trehozhatunk, \u00e9s elrejthetj\u00fck a felhaszn\u00e1l\u00f3i adatokat. Az ir\u00e1ny\u00edt\u00f3pultokn\u00e1l t\u00e1mogatott az import\/export sablonok, a rendszeres PDF\/Excel kiexport\u00e1l\u00e1s az adminisztr\u00e1tor e-mail c\u00edm\u00e9re, valamint az adatfriss\u00edt\u00e9s automatikus be\u00e1ll\u00edt\u00e1sa a val\u00f3s idej\u0171 biztons\u00e1gi esem\u00e9nyek nyomon k\u00f6vet\u00e9s\u00e9hez.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Kieg\u00e9sz\u00edt\u0151 monitoring szakaszok<\/h2>\n

\nA Management Platform monitoroz\u00f3 eszk\u00f6zeinek le\u00edr\u00e1sa hi\u00e1nyos lenne az Overview, Computer Management, Endpoint Settings \u00e9s Push Operations szakaszok eml\u00edt\u00e9se n\u00e9lk\u00fcl. Ezek a szakaszok r\u00e9szletesen le vannak \u00edrva a m\u00e1sodik cikkben<\/a><\/noindex>, azonban hasznos lesz megvizsg\u00e1lni k\u00e9pess\u00e9geiket a monitoring feladatok megold\u00e1s\u00e1hoz. Kezdj\u00fck az Overview-val, mely k\u00e9t alfejezetb\u0151l \u00e1ll - Operational Overview \u00e9s Security Overview, amelyek ir\u00e1ny\u00edt\u00f3pultok az v\u00e9dett felhaszn\u00e1l\u00f3i g\u00e9pek \u00e1llapot\u00e1r\u00f3l \u00e9s a biztons\u00e1gi esem\u00e9nyekr\u0151l. Mint b\u00e1rmely m\u00e1s ir\u00e1ny\u00edt\u00f3pult eset\u00e9ben, az Operational Overview \u00e9s Security Overview alfejezetek dupla kattint\u00e1ssal az \u00e9rdekl\u0151d\u0151 param\u00e9terre lehet\u0151v\u00e9 teszik, hogy a Computer Management r\u00e9szre navig\u00e1ljunk megadott sz\u0171r\u0151vel (p\u00e9ld\u00e1ul: \u201eDesktops\u201d vagy \u201ePre-Boot Status: Enabled\u201d), vagy a megfelel\u0151 esem\u00e9nyhez a Logs r\u00e9szre. A Security Overview alfejezet az \u201eCyber Attack View \u2013 Endpoint\u201d ir\u00e1ny\u00edt\u00f3pult, amelyet testre lehet szabni, \u00e9s be\u00e1ll\u00edthat\u00f3 az adatok automatikus friss\u00edt\u00e9se.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

A Computer Management r\u00e9szr\u0151l nyomon k\u00f6vethet\u0151 az \u00fcgyn\u00f6k \u00e1llapota a felhaszn\u00e1l\u00f3i g\u00e9peken, az Anti-Malware adatb\u00e1zis friss\u00edt\u00e9si st\u00e1tusza, a lemez titkos\u00edt\u00e1si f\u00e1zisai, \u00e9s sok m\u00e1s dolog. Mindezek az adatok automatikusan friss\u00fclnek, \u00e9s minden egyes sz\u0171r\u0151n\u00e9l megjelenik a megfelel\u0151 felhaszn\u00e1l\u00f3i g\u00e9pek sz\u00e1zal\u00e9kos ar\u00e1nya. Tov\u00e1bb\u00e1, az adatok sz\u00e1m\u00edt\u00f3g\u00e9pek export\u00e1l\u00e1sa CSV form\u00e1tumban is t\u00e1mogatott.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

A munkahelyi \u00e1llom\u00e1sok biztons\u00e1g\u00e1nak monitoroz\u00e1s\u00e1nak fontos szempontja a kritikus esem\u00e9nyekr\u0151l (Alerts) sz\u00f3l\u00f3 \u00e9rtes\u00edt\u00e9sek be\u00e1ll\u00edt\u00e1sa \u00e9s a logok export\u00e1l\u00e1sa (Export Events) a c\u00e9g log-szerver\u00e9re val\u00f3 t\u00e1rol\u00e1s c\u00e9lj\u00e1b\u00f3l. Mindk\u00e9t be\u00e1ll\u00edt\u00e1st az Endpoint Settings r\u00e9szben hajtj\u00e1k v\u00e9gre, \u00e9s a Figyelmeztet\u00e9sek<\/i> Lehet\u0151s\u00e9g van e-mail szerver csatlakoztat\u00e1s\u00e1ra az adminisztr\u00e1tornak k\u00fcld\u00f6tt esem\u00e9ny\u00e9rtes\u00edt\u00e9sekhez, valamint a riaszt\u00e1sok k\u00fcsz\u00f6b\u00e9rt\u00e9keinek be\u00e1ll\u00edt\u00e1s\u00e1ra az esem\u00e9ny bek\u00f6vetkez\u00e9sekor a megfelel\u0151 eszk\u00f6z\u00f6k sz\u00e1zal\u00e9ka \/ sz\u00e1ma alapj\u00e1n. Esem\u00e9nyek export\u00e1l\u00e1sa<\/i> Lehet\u0151v\u00e9 teszi a napl\u00f3k tov\u00e1bb\u00edt\u00e1s\u00e1nak be\u00e1ll\u00edt\u00e1s\u00e1t a Management Platformb\u00f3l a v\u00e1llalati napl\u00f3serverre tov\u00e1bbi feldolgoz\u00e1s c\u00e9lj\u00e1b\u00f3l. T\u00e1mogatott form\u00e1tumok: SYSLOG, CEF, LEEF, SPLUNK, TCP\/UDP protokollok, b\u00e1rmely SIEM rendszer m\u0171k\u00f6d\u0151 syslog-\u00fcgyn\u00f6kkel, TLS\/SSL titkos\u00edt\u00e1s haszn\u00e1lata \u00e9s syslog-kliens hiteles\u00edt\u00e9se.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

A SandBlast Agent \u00fcgyf\u00e9lt\u0151l t\u00f6rt\u00e9n\u0151 napl\u00f3k gyors gy\u0171jt\u00e9s\u00e9re, illetve technikai t\u00e1mogat\u00e1s ig\u00e9nyl\u00e9sekor a Push Operations r\u00e9szben k\u00e9nyszer\u00edtett m\u0171velettel lehet\u0151s\u00e9g van. Az elk\u00e9sz\u00edtett napl\u00f3arch\u00edvum tov\u00e1bb\u00edt\u00e1s\u00e1t be\u00e1ll\u00edthatjuk a Check Point szerverekre vagy a v\u00e1llalati szerverekre; a napl\u00f3arch\u00edvum a felhaszn\u00e1l\u00f3i g\u00e9pen a C:UsersusernameCPInfo k\u00f6nyvt\u00e1rban is t\u00e1rol\u00e1sra ker\u00fcl. T\u00e1mogatja a napl\u00f3gya\u0171jt\u00e9si folyamat tervezett id\u0151ben t\u00f6rt\u00e9n\u0151 ind\u00edt\u00e1s\u00e1t, \u00e9s a felhaszn\u00e1l\u00f3 \u00e1ltal k\u00e9sleltetett m\u0171veletet is.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Fenyeget\u00e9skeres\u00e9s<\/h2>\n

\nA fenyeget\u00e9skeres\u00e9s m\u00f3dszere a rosszindulat\u00fa tev\u00e9kenys\u00e9gek \u00e9s a rendszerben tapasztalhat\u00f3 anom\u00e1lis viselked\u00e9s proakt\u00edv keres\u00e9s\u00e9re szolg\u00e1l, a potenci\u00e1lis biztons\u00e1gi esem\u00e9nyek tov\u00e1bbi nyomoz\u00e1sa \u00e9rdek\u00e9ben. A Management Platform fenyeget\u00e9skeres\u00e9s szakasza lehet\u0151v\u00e9 teszi esem\u00e9nyek keres\u00e9s\u00e9t a felhaszn\u00e1l\u00f3i g\u00e9pen megadott param\u00e9terekkel.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

A fenyeget\u00e9skeres\u0151 eszk\u00f6z t\u00f6bb el\u0151re megadott lek\u00e9rdez\u00e9st tartalmaz, p\u00e9ld\u00e1ul a rosszindulat\u00fa domainek vagy f\u00e1jlok oszt\u00e1lyoz\u00e1s\u00e1ra, vagy ritka IP-c\u00edmek megkeres\u00e9s\u00e9re a statisztika alapj\u00e1n. A lek\u00e9rdez\u00e9s strukt\u00far\u00e1ja h\u00e1rom param\u00e9terb\u0151l \u00e1ll: indik\u00e1tor<\/i> (h\u00e1l\u00f3zati protokoll, folyamat azonos\u00edt\u00f3, f\u00e1jl t\u00edpusa stb.), oper\u00e1tort k\u00e9sz\u00edtenek<\/i> (\u201evan\u201d, \u201enincs\u201d, \u201etartalmazza\u201d, \u201eegyik\u201d stb.) \u00e9s lek\u00e9rdez\u00e9s t\u00f6rzse<\/i>. A lek\u00e9rdez\u00e9s t\u00f6rzs\u00e9ben regul\u00e1ris kifejez\u00e9sek haszn\u00e1lata is lehets\u00e9ges, t\u00f6bb sz\u0171r\u0151 egyidej\u0171 haszn\u00e1lat\u00e1t t\u00e1mogatja a keres\u0151sz\u00f3ban.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

A sz\u0171r\u0151 kiv\u00e1laszt\u00e1sa ut\u00e1n \u00e9s a k\u00e9r\u00e9s feldolgoz\u00e1sa befejezte, hozz\u00e1f\u00e9r\u00e9s ny\u00edlik minden alkalmas esem\u00e9nyhez, melyekre r\u00e9szletes inform\u00e1ci\u00f3k tekinthet\u0151k meg, a k\u00e9r\u00e9s objektuma karant\u00e9nba helyezhet\u0151, vagy r\u00e9szletes Forensics Report gener\u00e1lhat\u00f3 az esem\u00e9ny le\u00edr\u00e1s\u00e1val. Jelenleg ez az eszk\u00f6z b\u00e9taverzi\u00f3ban \u00e9rhet\u0151 el, \u00e9s a j\u00f6v\u0151ben a funkci\u00f3k k\u00f6r\u00e9nek b\u0151v\u00edt\u00e9se tervezi, p\u00e9ld\u00e1ul esem\u00e9nyinform\u00e1ci\u00f3k hozz\u00e1ad\u00e1s\u00e1t a Mitre Att&ck m\u00e1trix form\u00e1j\u00e1ban.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Z\u00e1r\u00e1s<\/h3>\n

\n\u00d6sszegezz\u00fck: ebben a cikkben megvizsg\u00e1ltuk a biztons\u00e1gi esem\u00e9nyek monitoroz\u00e1s\u00e1nak lehet\u0151s\u00e9geit a SandBlast Agent Management Platformon, felfedezt\u00fck az \u00faj eszk\u00f6zt a felhaszn\u00e1l\u00f3i g\u00e9peken t\u00f6rt\u00e9n\u0151 rosszindulat\u00fa tev\u00e9kenys\u00e9gek \u00e9s anom\u00e1li\u00e1k proakt\u00edv keres\u00e9s\u00e9re \u2014 Threat Hunting. A k\u00f6vetkez\u0151 cikk lesz az utols\u00f3 ebben a ciklusban, amelyben a Management Platform megold\u00e1saira vonatkoz\u00f3 leggyakoribb k\u00e9rd\u00e9seket t\u00e1rgyaljuk \u00e9s a term\u00e9k tesztel\u00e9si lehet\u0151s\u00e9geir\u0151l besz\u00e9l\u00fcnk.<\/p>\n

Sz\u00e9lesk\u00f6r\u0171 anyaggy\u0171jtem\u00e9ny a Check Point-r\u00f3l a TS Solution-t\u00f3l<\/a><\/noindex>. Hogy ne maradjon le a SandBlast Agent Management Platform t\u00e9mak\u00f6r\u00e9be v\u00e1g\u00f3 k\u00e9s\u0151bbi publik\u00e1ci\u00f3kr\u00f3l \u2014 k\u00f6vesse nyomon friss\u00edt\u00e9seinket k\u00f6z\u00f6ss\u00e9gi m\u00e9dia csatorn\u00e1inkon (Telegram<\/a><\/noindex>, Facebook<\/a><\/noindex>, VK<\/a><\/noindex>, TS Solution Blog<\/a><\/noindex>, Yandex.Zen<\/a><\/noindex>).
\n
Forr\u00e1s: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u044f\u0442\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u0446\u0438\u043a\u043b\u0430 \u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Check Point SandBlast Agent Management Platform. \u0421 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0441\u0442\u0430\u0442\u044c\u044f\u043c\u0438 \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f, \u043f\u0435\u0440\u0435\u0439\u0434\u044f \u043f\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0441\u044b\u043b\u043a\u0435: \u043f\u0435\u0440\u0432\u0430\u044f, \u0432\u0442\u043e\u0440\u0430\u044f, \u0442\u0440\u0435\u0442\u044c\u044f, \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0432 Management Platform, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u043b\u043e\u0433\u0430\u043c\u0438, \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u0430\u043c\u0438 (View) \u0438 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0435\u043c \u0442\u0435\u043c\u0443 Threat Hunting \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92914,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92913","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Napl\u00f3k, Jelent\u00e9sek & Forensics. Threat Hunting | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logs, Reports & Forensics. Threat Hunting | ProHoster","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-01T11:42:56+00:00","article:modified_time":"2020-09-01T11:42:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92913","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:58:25","updated":"2022-09-30 07:34:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/92913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=92913"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/92913\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/92914"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=92913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=92913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=92913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}