{"id":92913,"date":"2020-09-01T13:42:56","date_gmt":"2020-09-01T11:42:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting"},"modified":"2020-09-01T13:42:56","modified_gmt":"2020-09-01T11:42:56","slug":"5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","title":{"rendered":"5. Check Point SandBlast Agent Management Platform. Registros, Relat\u00f3rios &amp; An\u00e1lise Forense. Ca\u00e7a a Amea\u00e7as","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/a7187930f8cd3b00abd80e0f8d9f0324.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBem-vindo ao quinto artigo da s\u00e9rie sobre a solu\u00e7\u00e3o Check Point SandBlast Agent Management Platform. Voc\u00ea pode acessar os artigos anteriores clicando no link correspondente: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511768\/\">primeiro<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/512614\/\">segundo<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/513254\/\">terceiro<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/515172\/\">quarto<\/a><\/noindex>. Hoje, discutiremos as capacidades de monitoramento na Management Platform, especificamente a intera\u00e7\u00e3o com logs, pain\u00e9is de visualiza\u00e7\u00e3o interativos e relat\u00f3rios. Tamb\u00e9m abordaremos a quest\u00e3o de Threat Hunting para identificar amea\u00e7as atuais e eventos an\u00f4malos na m\u00e1quina do usu\u00e1rio.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Logs<\/h2>\n<p>\nA principal fonte de informa\u00e7\u00e3o para monitoramento de eventos de seguran\u00e7a \u00e9 a se\u00e7\u00e3o Logs, que exibe informa\u00e7\u00f5es detalhadas sobre cada incidente, al\u00e9m de permitir o uso de filtros pr\u00e1ticos para refinar os crit\u00e9rios de busca. Por exemplo, ao clicar com o bot\u00e3o direito do mouse em um par\u00e2metro (Blade, Action, Severity, etc.) de um log de interesse, esse par\u00e2metro pode ser filtrado como <i>Filtro: \u00abPar\u00e2metro\u00bb<\/i> ou <i>Filtrar: \u00abPar\u00e2metro\u00bb<\/i>. Para o par\u00e2metro Source, a op\u00e7\u00e3o IP Tools pode ser selecionada, permitindo executar um ping no endere\u00e7o IP\/nome ou realizar um nslookup para obter o endere\u00e7o IP da fonte pelo nome.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/er\/gj\/-r\/ergj-rhqeb5doaruijchefsbbmc.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/b38e68cc93766b19f412e89fd4e851f3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Na se\u00e7\u00e3o Logs, para filtrar eventos, h\u00e1 uma subse\u00e7\u00e3o Statistics, que exibe estat\u00edsticas sobre todos os par\u00e2metros: um gr\u00e1fico temporal com a quantidade de logs, assim como percentuais de cada um dos par\u00e2metros. Dessa subse\u00e7\u00e3o, \u00e9 f\u00e1cil filtrar logs sem recorrer \u00e0 barra de busca e escrita de express\u00f5es de filtragem \u2014 basta selecionar os par\u00e2metros desejados e uma nova lista de logs ser\u00e1 exibida imediatamente.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/sm\/gm\/mf\/smgmmffyujvi1crg45z5uitlvwa.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/10deab53312dbef413e58f7edb5f43f0.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Informa\u00e7\u00f5es detalhadas sobre cada log est\u00e3o dispon\u00edveis no painel \u00e0 direita da se\u00e7\u00e3o Logs, mas \u00e9 mais conveniente abrir o log com um duplo clique para analisar o conte\u00fado. Abaixo est\u00e1 um exemplo de log (imagem clic\u00e1vel) que mostra informa\u00e7\u00f5es detalhadas sobre a ativa\u00e7\u00e3o da a\u00e7\u00e3o Prevent do blade Threat Emulation em um arquivo infectado \".docx\". O log possui v\u00e1rias subse\u00e7\u00f5es que exibem detalhes do evento de seguran\u00e7a: pol\u00edticas e prote\u00e7\u00f5es acionadas, detalhes forenses, informa\u00e7\u00f5es sobre o cliente e tr\u00e1fego. Merecem especial aten\u00e7\u00e3o os relat\u00f3rios dispon\u00edveis no log \u2014 Threat Emulation Report e Forensics Report. Esses relat\u00f3rios tamb\u00e9m podem ser abertos a partir do cliente SandBlast Agent.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/u5\/ch\/e1\/u5che1n2ww-hycuu8j1-55cadfi.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/2e3650320a5e06a7c0503433ac4ad541.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Threat Emulation Report<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ns\/h4\/_k\/nsh4_knfdmptu_-nfd97_pemoim.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/b0d753ec281f8409fe02946f9a3680b3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Ao utilizar o blade Threat Emulation, ap\u00f3s a execu\u00e7\u00e3o da emula\u00e7\u00e3o na nuvem Check Point, aparece um link no log correspondente para um relat\u00f3rio detalhado sobre os resultados da emula\u00e7\u00e3o \u2014 Threat Emulation Report. O conte\u00fado desse relat\u00f3rio \u00e9 descrito em detalhes em nosso artigo sobre <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/477494\/\">an\u00e1lise de malware com a forense Check Point SandBlast Network<\/a><\/noindex>. Vale ressaltar que este relat\u00f3rio \u00e9 interativo e permite \"mergulhar\" nos detalhes de cada uma das se\u00e7\u00f5es. Tamb\u00e9m \u00e9 poss\u00edvel visualizar a grava\u00e7\u00e3o do processo de emula\u00e7\u00e3o em uma m\u00e1quina virtual, baixar o arquivo malicioso original ou obter seu hash, al\u00e9m de entrar em contato com a equipe de resposta a incidentes da Check Point.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/8a\/lh\/xx\/8alhxxvnjs1ewg8b4_2vb9w1464.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/9048cf717e020ae6d5bf2c106397bfe3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Forensics Report<\/h3>\n<p>\nPraticamente para qualquer evento de seguran\u00e7a, um relat\u00f3rio Forensics Report \u00e9 gerado, que inclui informa\u00e7\u00f5es detalhadas sobre o arquivo malicioso: suas caracter\u00edsticas, a\u00e7\u00f5es, ponto de entrada no sistema e impacto sobre ativos importantes da empresa. A estrutura do relat\u00f3rio foi discutida em nosso artigo sobre <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/478396\/\">an\u00e1lise de malware com a forense Check Point SandBlast Agent<\/a><\/noindex>. Esse tipo de relat\u00f3rio \u00e9 uma importante fonte de informa\u00e7\u00e3o durante investiga\u00e7\u00f5es de eventos de seguran\u00e7a, e se necess\u00e1rio, o conte\u00fado do relat\u00f3rio pode ser imediatamente enviado para a equipe de resposta a incidentes da Check Point.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/wh\/qb\/pe\/whqbpe7hlwwujwxdv4um42eb-no.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/7010f25765e6c3bfb6dff40a8cf48e24.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h2>SmartView<\/h2>\n<p>\nO Check Point SmartView \u00e9 uma ferramenta conveniente para construir e visualizar dashboards din\u00e2micos (View) e relat\u00f3rios em formato PDF. A partir do SmartView, tamb\u00e9m \u00e9 poss\u00edvel visualizar logs de usu\u00e1rios e eventos de auditoria para administradores. Abaixo, est\u00e3o os relat\u00f3rios e dashboards mais \u00fateis para trabalhar com o SandBlast Agent.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/wr\/e5\/yo\/wre5yoe7iptzwak-7vgbmszpzky.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/62a262c57811eede4609637590481ef0.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Os relat\u00f3rios no SmartView s\u00e3o documentos com informa\u00e7\u00f5es estat\u00edsticas sobre eventos em um determinado per\u00edodo de tempo. Suporta a exporta\u00e7\u00e3o de relat\u00f3rios em formato PDF para a m\u00e1quina onde o SmartView est\u00e1 aberto, al\u00e9m da exporta\u00e7\u00e3o regular em PDF\/Excel para o e-mail do administrador. Al\u00e9m disso, suporta a importa\u00e7\u00e3o\/exporta\u00e7\u00e3o de modelos de relat\u00f3rios, cria\u00e7\u00e3o de relat\u00f3rios personalizados e a possibilidade de ocultar nomes de usu\u00e1rios nos relat\u00f3rios. Abaixo est\u00e1 um exemplo de relat\u00f3rio integrado de Threat Prevention.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/c2\/ol\/br\/c2olbrgf6jufazr6w6wzhi7rxgg.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/293e7d94792e09eefe93981369af817b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Os dashboards (View) no SmartView permitem que o administrador acesse os logs de eventos correspondentes \u2014 basta clicar duas vezes no objeto de interesse, seja uma coluna do gr\u00e1fico ou o nome de um arquivo malicioso. Assim como nos relat\u00f3rios, \u00e9 poss\u00edvel criar dashboards personalizados e ocultar dados dos usu\u00e1rios. Os dashboards tamb\u00e9m suportam a importa\u00e7\u00e3o\/exporta\u00e7\u00e3o de templates, exporta\u00e7\u00e3o regular em PDF\/Excel para o e-mail do administrador e atualiza\u00e7\u00e3o autom\u00e1tica de dados para monitoramento de eventos de seguran\u00e7a em tempo real.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/md\/ob\/l3\/mdobl3ed5laokqioysiwzs6h3yi.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/efd3584fdb1e1d61109e55a4137c8e0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h2>Se\u00e7\u00f5es adicionais de monitoramento<\/h2>\n<p>\nA descri\u00e7\u00e3o dos recursos de monitoramento na Management Platform seria incompleta sem mencionar as se\u00e7\u00f5es Overview, Computer Management, Endpoint Settings e Push Operations. Essas se\u00e7\u00f5es foram detalhadas no <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/512614\/\">segundo artigo<\/a><\/noindex>, no entanto, \u00e9 \u00fatil considerar suas capacidades para resolver tarefas de monitoramento. Come\u00e7aremos com Overview, que consiste em duas subse\u00e7\u00f5es \u2014 Operational Overview e Security Overview, que s\u00e3o dashboards com informa\u00e7\u00f5es sobre o estado das m\u00e1quinas de usu\u00e1rios protegidas e eventos de seguran\u00e7a. Assim como ao interagir com qualquer outro dashboard, as subse\u00e7\u00f5es Operational Overview e Security Overview permitem, ao clicar duas vezes no par\u00e2metro desejado, acessar a se\u00e7\u00e3o Computer Management com um filtro selecionado (por exemplo, 'Desktops' ou 'Pre-Boot Status: Enabled'), ou a se\u00e7\u00e3o Logs para um evento espec\u00edfico. A subse\u00e7\u00e3o Security Overview \u00e9 um dashboard 'Cyber Attack View \u2013 Endpoint', que pode ser configurado 'a gosto' e tem atualiza\u00e7\u00e3o autom\u00e1tica de dados.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/--\/bl\/sr\/--blsrbxcaapnnnckd5ov9in5rk.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/4f49d2a2f33f64cf65924ff3a1140e19.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Na se\u00e7\u00e3o Computer Management, \u00e9 poss\u00edvel monitorar o estado do agente nas m\u00e1quinas dos usu\u00e1rios, o status de atualiza\u00e7\u00e3o da base de dados Anti-Malware, as etapas de criptografia do disco e muito mais. Todos os dados s\u00e3o atualizados automaticamente, e para cada um dos filtros, \u00e9 exibido um percentual de m\u00e1quinas de usu\u00e1rios adequadas. Tamb\u00e9m \u00e9 suportada a exporta\u00e7\u00e3o de dados dos computadores em formato CSV.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ij\/zi\/ni\/ijzinixrgrhpci2cgi3hugndspw.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/fd99e1dbfa12324f44bd18bfd07a7632.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Um aspecto importante do monitoramento da seguran\u00e7a das esta\u00e7\u00f5es de trabalho \u00e9 a configura\u00e7\u00e3o de notifica\u00e7\u00f5es sobre eventos cr\u00edticos (Alerts) e a exporta\u00e7\u00e3o de logs (Export Events) para armazenamento no servidor de logs da empresa. Ambas as configura\u00e7\u00f5es s\u00e3o realizadas na se\u00e7\u00e3o Endpoint Settings, e para <i>Alerts<\/i> \u00e9 poss\u00edvel conectar um servidor de e-mail para enviar notifica\u00e7\u00f5es sobre eventos ao administrador e configurar os limites de ativa\u00e7\u00e3o\/desativa\u00e7\u00e3o de notifica\u00e7\u00f5es com base na porcentagem\/n\u00famero de dispositivos que atendem aos crit\u00e9rios do evento. <i>Exportar Eventos<\/i> permite configurar o encaminhamento de logs da plataforma de gerenciamento para o servidor de logs da empresa para processamento posterior. Os formatos SYSLOG, CEF, LEEF, SPLUNK s\u00e3o suportados, bem como os protocolos TCP\/UDP e qualquer sistema SIEM com um agente syslog ativo, com suporte a criptografia TLS\/SSL e autentica\u00e7\u00e3o do cliente syslog.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/vx\/73\/o0\/vx73o0ismioxm9l-ymvdvfkjhny.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/b9af095705868c7ba9f63d4d927bdae5.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Para uma an\u00e1lise aprofundada de eventos no agente ou em caso de contato com o suporte t\u00e9cnico, \u00e9 poss\u00edvel coletar rapidamente os logs do cliente SandBlast Agent usando uma opera\u00e7\u00e3o for\u00e7ada na se\u00e7\u00e3o Opera\u00e7\u00f5es Push. \u00c9 poss\u00edvel configurar o envio do arquivo de log gerado para os servidores Check Point ou para servidores corporativos; al\u00e9m disso, o arquivo de log \u00e9 salvo na m\u00e1quina do usu\u00e1rio no diret\u00f3rio C:UsersusernameCPInfo. O processo de coleta de logs pode ser agendado em um hor\u00e1rio espec\u00edfico, com a possibilidade de adiar a opera\u00e7\u00e3o pelo usu\u00e1rio.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/iy\/5u\/6o\/iy5u6ovlg4fxi-ex0whpxh4yjms.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/2ef458a297b223b30813091f54195d76.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h2>Ca\u00e7a a Amea\u00e7as<\/h2>\n<p>\nO m\u00e9todo de Ca\u00e7a a Amea\u00e7as \u00e9 utilizado para a busca proativa de atividades maliciosas e comportamentos an\u00f4malos no sistema para posterior investiga\u00e7\u00e3o de poss\u00edveis eventos de seguran\u00e7a. A se\u00e7\u00e3o de Ca\u00e7a a Amea\u00e7as na plataforma de gerenciamento permite a busca por eventos com par\u00e2metros espec\u00edficos nos dados da m\u00e1quina do usu\u00e1rio.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/su\/2p\/l5\/su2pl5rwsc32slfnokqn_rrqtus.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/3f771fbea121a78d1d50daf42f1643cb.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>A ferramenta de Ca\u00e7a a Amea\u00e7as possui v\u00e1rias consultas pr\u00e9-configuradas, por exemplo: para classificar dom\u00ednios ou arquivos maliciosos, rastrear acessos raros a certos endere\u00e7os IP (relative \u00e0 estat\u00edstica geral). A estrutura da consulta consiste em tr\u00eas par\u00e2metros: <i>indicador<\/i> (protocolo de rede, identificador de processo, tipo de arquivo, etc.), <i>operador<\/i> ('\u00e9', 'n\u00e3o \u00e9', 'inclui', 'um dos', etc.) e <i>corpo da consulta<\/i>. No corpo da consulta, express\u00f5es regulares podem ser usadas, sendo suportado o uso de v\u00e1rios filtros simultaneamente na linha de busca.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/1y\/3c\/2a\/1y3c2acosy5e22pturoe7khfchq.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/c0070db473264069eda4f07a919eaa8c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Ap\u00f3s a sele\u00e7\u00e3o do filtro e a conclus\u00e3o do processamento da solicita\u00e7\u00e3o, fica dispon\u00edvel o acesso a todos os eventos relevantes, com a possibilidade de visualizar detalhes sobre o evento, colocar o objeto da solicita\u00e7\u00e3o em quarentena ou gerar um Relat\u00f3rio Forense detalhado que descreve o evento. No momento, esta ferramenta est\u00e1 em vers\u00e3o beta e, futuramente, est\u00e1 prevista a expans\u00e3o do conjunto de recursos, como a adi\u00e7\u00e3o de informa\u00e7\u00f5es sobre o evento em formato de matriz Mitre Att&amp;ck.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/i8\/uh\/ck\/i8uhckgoeakoqcbd7nqx1btijac.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/61c9043715428af9cbd90bd49e679ce3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Conclus\u00e3o<\/h3>\n<p>\nEm resumo: neste artigo, analisamos as capacidades de monitoramento de eventos de seguran\u00e7a na SandBlast Agent Management Platform, exploramos uma nova ferramenta para a busca proativa de a\u00e7\u00f5es maliciosas e anomalias nas m\u00e1quinas dos usu\u00e1rios \u2014 Threat Hunting. O pr\u00f3ximo artigo ser\u00e1 o conclusivo desta s\u00e9rie e nele abordaremos as perguntas mais frequentes sobre a solu\u00e7\u00e3o Management Platform e falaremos sobre as possibilidades de teste deste produto.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/358508\/\">Uma grande sele\u00e7\u00e3o de materiais sobre Check Point da TS Solution<\/a><\/noindex>. Para n\u00e3o perder as pr\u00f3ximas publica\u00e7\u00f5es sobre o tema SandBlast Agent Management Platform \u2014 acompanhe as atualiza\u00e7\u00f5es em nossas redes sociais (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blog da TS Solution<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/zen.yandex.ru\/id\/5c7d2162fa818600ae386a52\">Yandex.Zen<\/a><\/noindex>).<br \/>\n<br \/>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/516336\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u044f\u0442\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u0446\u0438\u043a\u043b\u0430 \u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Check Point SandBlast Agent Management Platform. \u0421 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0441\u0442\u0430\u0442\u044c\u044f\u043c\u0438 \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f, \u043f\u0435\u0440\u0435\u0439\u0434\u044f \u043f\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0441\u044b\u043b\u043a\u0435: \u043f\u0435\u0440\u0432\u0430\u044f, \u0432\u0442\u043e\u0440\u0430\u044f, \u0442\u0440\u0435\u0442\u044c\u044f, \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0432 Management Platform, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u043b\u043e\u0433\u0430\u043c\u0438, \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u0430\u043c\u0438 (View) \u0438 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0435\u043c \u0442\u0435\u043c\u0443 Threat Hunting \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92914,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92913","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logs, Reports &amp; Forensics. Threat Hunting | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-01T11:42:56+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-01T11:42:56+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logs, Relat\u00f3rios &amp; Forense. Threat Hunting | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logs, Reports &amp; Forensics. Threat Hunting | ProHoster","og:url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-01T11:42:56+00:00","article:modified_time":"2020-09-01T11:42:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92913","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:58:25","updated":"2022-09-30 07:34:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/92913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=92913"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/92913\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/92914"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=92913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=92913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=92913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}