{"id":92913,"date":"2020-09-01T13:42:56","date_gmt":"2020-09-01T11:42:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting"},"modified":"2020-09-01T13:42:56","modified_gmt":"2020-09-01T11:42:56","slug":"5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","title":{"rendered":"5. Platforma de Management Agent SandBlast de la Check Point. Jurnale, Raporturi \u0219i Forenizic\u0103. V\u00e2n\u0103toare de amenin\u021b\u0103ri","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/a7187930f8cd3b00abd80e0f8d9f0324.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBine a\u021bi venit la al cincilea articol din ciclul despre solu\u021bia Platforma de Management Agent SandBlast de la Check Point. Pute\u021bi consulta articolele anterioare acces\u00e2nd linkul corespunz\u0103tor: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511768\/\">prima<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/512614\/\">a doua<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/513254\/\">treilea<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/515172\/\">patru<\/a><\/noindex>. Ast\u0103zi vom examina func\u021bionalit\u0103\u021bile de monitorizare din Platforma de Management, \u00een special lucrul cu jurnalele, tablourile de bord interactive (View) \u0219i rapoartele. De asemenea, vom aborda subiectul V\u00e2n\u0103torii de amenin\u021b\u0103ri pentru identificarea amenin\u021b\u0103rilor actuale \u0219i a evenimentelor anormale de pe ma\u0219ina utilizatorului.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Jurnale<\/h2>\n<p>\nPrincipala surs\u0103 de informa\u021bii pentru monitorizarea evenimentelor de securitate este sec\u021biunea Jurnale, care afi\u0219eaz\u0103 informa\u021bii detaliate despre fiecare incident \u0219i permite utilizarea de filtre convenabile pentru rafinarea criteriilor de c\u0103utare. De exemplu, c\u00e2nd se face clic dreapta pe un parametru (Blade, Action, Severity etc.) al jurnalului de interes, acest parametru poate fi filtrat ca <i>Filtru: \u201eParametru\u201d<\/i> sau <i>Filtru exclus: \u201eParametru\u201d<\/i>. De asemenea, pentru parametrul Surs\u0103 poate fi selectat\u0103 op\u021biunea IP Tools, \u00een care se poate efectua ping la aceast\u0103 adres\u0103 IP\/nume sau se poate realiza un nslookup pentru a ob\u021bine adresa IP a sursei dup\u0103 nume.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/er\/gj\/-r\/ergj-rhqeb5doaruijchefsbbmc.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/b38e68cc93766b19f412e89fd4e851f3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u00cen sec\u021biunea Jurnale pentru filtrarea evenimentelor exist\u0103 un subsec\u021biune Statistic\u0103, \u00een care se afi\u0219eaz\u0103 statistica pentru to\u021bi parametrii: un grafic temporal cu num\u0103rul de jurnale, precum \u0219i procentajele pentru fiecare dintre parametri. Din aceast\u0103 subsec\u021biune, jurnalele pot fi u\u0219or filtrate f\u0103r\u0103 a apela la bara de c\u0103utare \u0219i a scrie expresii de filtrare \u2014 este suficient s\u0103 selecta\u021bi parametrii de interes \u0219i lista nou\u0103 de jurnale se va afi\u0219a imediat.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/sm\/gm\/mf\/smgmmffyujvi1crg45z5uitlvwa.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/10deab53312dbef413e58f7edb5f43f0.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Informa\u021biile detaliate despre fiecare jurnal sunt disponibile \u00een panoul din dreapta sec\u021biunii Logs, \u00eens\u0103 este mai convenabil s\u0103 deschide\u021bi jurnalul printr-un dublu clic pentru a analiza con\u021binutul. Mai jos este un exemplu de jurnal (imaginea este clicabil\u0103), \u00een care este afi\u0219at\u0103 informa\u021bia detaliat\u0103 despre activarea ac\u021biunii Prevent a blade-ului Threat Emulation pe un fi\u0219ier infectat \".docx\". Jurnalul are mai multe subsec\u021biuni care afi\u0219eaz\u0103 detaliile evenimentului de securitate: politica \u0219i protec\u021bia activate, detalii pentruenzice, informa\u021bii despre client \u0219i trafic. Se remarc\u0103 rapoartele disponibile din jurnal \u2014 Threat Emulation Report \u0219i Forensics Report. Aceste rapoarte pot fi, de asemenea, deschise din clientul SandBlast Agent.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/u5\/ch\/e1\/u5che1n2ww-hycuu8j1-55cadfi.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/2e3650320a5e06a7c0503433ac4ad541.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Raport de Emula\u021bie a Amenin\u021b\u0103rilor<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ns\/h4\/_k\/nsh4_knfdmptu_-nfd97_pemoim.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/b0d753ec281f8409fe02946f9a3680b3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>C\u00e2nd utiliza\u021bi blade-ul Threat Emulation, dup\u0103 ce emula\u021bia a avut loc \u00een cloud-ul Check Point, \u00een jurnalul corespunz\u0103tor apare un link c\u0103tre un raport detaliat despre rezultatele emula\u021biei \u2014 Threat Emulation Report. Con\u021binutul acestui raport este detaliat \u00een articolul nostru despre <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/477494\/\">analiza malware-ului prin forenzica Check Point SandBlast Network<\/a><\/noindex>. Este de remarcat c\u0103 acest raport este interactiv \u0219i permite \u201eexplorarea\u201d detaliilor fiec\u0103rei sec\u021biuni. De asemenea, exist\u0103 posibilitatea de a vizualiza \u00eenregistrarea procesului de emula\u021bie \u00eentr-o ma\u0219in\u0103 virtual\u0103, de a desc\u0103rca fi\u0219ierul mali\u021bios original sau de a ob\u021bine hash-ul acestuia, precum \u0219i de a contacta echipa de r\u0103spuns la incidente Check Point.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/8a\/lh\/xx\/8alhxxvnjs1ewg8b4_2vb9w1464.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/9048cf717e020ae6d5bf2c106397bfe3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Forensics Report<\/h3>\n<p>\nPractic, pentru orice eveniment de securitate se genereaz\u0103 un raport Forensics Report, care include informa\u021bii detaliate despre fi\u0219ierul mali\u021bios: caracteristicile acestuia, ac\u021biuni, punctul de intrare \u00een sistem \u0219i influen\u021ba asupra activelor importante ale companiei. Structura raportului a fost detaliat\u0103 \u00een articolul nostru despre <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/478396\/\">analiza malware-ului prin forenzica Check Point SandBlast Agent<\/a><\/noindex>. Acest raport reprezint\u0103 o surs\u0103 important\u0103 de informa\u021bii \u00een investigarea evenimentelor de securitate, iar, dac\u0103 este necesar, con\u021binutul raportului poate fi trimis imediat echipei de r\u0103spuns la incidente Check Point.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/wh\/qb\/pe\/whqbpe7hlwwujwxdv4um42eb-no.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/7010f25765e6c3bfb6dff40a8cf48e24.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h2>SmartView<\/h2>\n<p>\nCheck Point SmartView este un instrument convenabil pentru construirea \u0219i vizualizarea dashboard-urilor dinamice (View) \u0219i a rapoartelor \u00een format PDF. Din SmartView, se pot vizualiza, de asemenea, jurnalele personalizate \u0219i evenimentele de audit pentru administratori. \u00cen imaginea de mai jos sunt prezentate cele mai utile rapoarte \u0219i dashboard-uri pentru lucrul cu SandBlast Agent.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/wr\/e5\/yo\/wre5yoe7iptzwak-7vgbmszpzky.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/62a262c57811eede4609637590481ef0.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Rapoartele din SmartView sunt documente cu informa\u021bii statistice privind evenimentele dintr-o anumit\u0103 perioad\u0103 de timp. Se sus\u021bine exportul rapoartelor \u00een format PDF pe ma\u0219ina unde este deschis SmartView, precum \u0219i exporturi regulate \u00een PDF\/Excel pe adresa de email a administratorului. \u00cen plus, se sus\u021bine importul\/exportul \u0219abloanelor de rapoarte, crearea de rapoarte proprii \u0219i posibilitatea de a ascunde numele utilizatorilor \u00een rapoarte. \u00cen imaginea de mai jos este prezentat un exemplu al raportului \u00eencorporat Threat Prevention.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/c2\/ol\/br\/c2olbrgf6jufazr6w6wzhi7rxgg.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/293e7d94792e09eefe93981369af817b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Dashboards (View) \u00een SmartView permit administratorului s\u0103 acceseze jurnalele pentru evenimentul corespunz\u0103tor \u2014 este suficient s\u0103 fac\u0103 clic de dou\u0103 ori pe obiectul de interes, fie c\u0103 este vorba despre o coloan\u0103 a graficului sau un nume de fi\u0219ier mali\u021bios. La fel ca \u00een cazul rapoartelor, este posibil s\u0103 crea\u021bi propriile dashboards \u0219i s\u0103 ascunde\u021bi datele utilizatorilor. De asemenea, pentru dashboards este acceptat importul\/exportul de \u0219abloane, exportul regulat \u00een PDF\/Excel pe adresa de email a administratorului \u0219i actualizarea automat\u0103 a datelor pentru monitorizarea evenimentelor de securitate \u00een timp real.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/md\/ob\/l3\/mdobl3ed5laokqioysiwzs6h3yi.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/efd3584fdb1e1d61109e55a4137c8e0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h2>Sec\u021biuni suplimentare de monitorizare<\/h2>\n<p>\nDescrierea instrumentelor de monitorizare din Platforma de Management va fi incomplet\u0103 f\u0103r\u0103 a men\u021biona sec\u021biunile Overview, Computer Management, Endpoint Settings \u0219i Push Operations. Aceste sec\u021biuni au fost detaliate \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/512614\/\">articolul doi<\/a><\/noindex>, \u00eens\u0103 va fi util s\u0103 analiz\u0103m func\u021bionalit\u0103\u021bile lor pentru solu\u021bionarea sarcinilor de monitorizare. Vom \u00eencepe cu Overview, care este format din dou\u0103 sub-sec\u021biuni \u2014 Operational Overview \u0219i Security Overview, care constituie dashboards cu informa\u021bii despre starea ma\u0219inilor utilizatorilor protejate \u0219i evenimentele de securitate. La fel ca \u00een interac\u021biunea cu orice alt dashboard, sub-sec\u021biunile Operational Overview \u0219i Security Overview permit, prin dublu clic pe un parametru de interes, accesul la sec\u021biunea Computer Management cu filtrul selectat (de exemplu, \u201eDesktops\u201d sau \u201ePre-Boot Status: Enabled\u201d), sau la sec\u021biunea Logs pentru un eveniment specific. Sub-sec\u021biunea Security Overview reprezint\u0103 un dashboard \u201eCyber Attack View \u2013 Endpoint\u201d, care poate fi personalizat \u201edup\u0103 propriile preferin\u021be\u201d \u0219i setat pentru actualizarea automat\u0103 a datelor.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/--\/bl\/sr\/--blsrbxcaapnnnckd5ov9in5rk.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/4f49d2a2f33f64cf65924ff3a1140e19.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Din sec\u021biunea Computer Management se poate urm\u0103ri starea agentului pe ma\u0219inile utilizatorilor, starea actualiz\u0103rii bazei de date Anti-Malware, etapele de criptare a discului \u0219i multe altele. Toate datele sunt actualizate automat, iar pentru fiecare dintre filtre se afi\u0219eaz\u0103 procentajul ma\u0219inilor utilizatorilor potrivite. De asemenea, este acceptat exportul datelor despre computere \u00een format CSV.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ij\/zi\/ni\/ijzinixrgrhpci2cgi3hugndspw.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/fd99e1dbfa12324f44bd18bfd07a7632.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Un aspect important al monitoriz\u0103rii securit\u0103\u021bii sta\u021biilor de lucru este configurarea notific\u0103rilor pentru evenimente critice (Alerts) \u0219i exportul jurnalele (Export Events) pentru stocarea pe serverul de jurnale al companiei. Ambele set\u0103ri se realizeaz\u0103 \u00een sec\u021biunea Endpoint Settings, iar pentru <i>Alerts<\/i> Exist\u0103 posibilitatea de a conecta un server de po\u0219t\u0103 electronic\u0103 pentru a trimite notific\u0103ri administratorului despre evenimente \u0219i de a configura pragurile de activare\/dezactivare a notific\u0103rilor \u00een func\u021bie de procentul\/num\u0103rul de dispozitive care \u00eendeplinesc criteriile evenimentului. <i>Export Evenimente<\/i> Permite configurarea redirec\u021bion\u0103rii jurnalelor din Management Platform c\u0103tre serverul de jurnal al companiei pentru procesare ulterioar\u0103. Se sus\u021bin formatele SYSLOG, CEF, LEEF, SPLUNK, protocoalele TCP\/UDP, orice sistem SIEM cu agent syslog func\u021bional, utilizarea cript\u0103rii TLS\/SSL \u0219i autentificarea clientului syslog.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/vx\/73\/o0\/vx73o0ismioxm9l-ymvdvfkjhny.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/b9af095705868c7ba9f63d4d927bdae5.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Pentru o analiz\u0103 detaliat\u0103 a evenimentelor pe agent sau \u00een cazul contact\u0103rii asisten\u021bei tehnice, se pot colecta rapid jurnalele de pe clientul SandBlast Agent prin intermediul unei opera\u021biuni for\u021bate \u00een sec\u021biunea Push Operations. Se poate configura redirec\u021bionarea arhivei de jurnale c\u0103tre serverele Check Point sau c\u0103tre serverele corporative, de asemenea, arhiva de jurnale este salvat\u0103 pe ma\u0219ina utilizatorului \u00een directorul C:\\Users\\username\\CPInfo. Se sus\u021bine ini\u021bierea procesului de colectare a jurnalelor la un moment specificat \u0219i posibilitatea de a am\u00e2na opera\u021biunea de c\u0103tre utilizator.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/iy\/5u\/6o\/iy5u6ovlg4fxi-ex0whpxh4yjms.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/2ef458a297b223b30813091f54195d76.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h2>C\u0103utarea de Amenin\u021b\u0103ri<\/h2>\n<p>\nMetoda C\u0103ut\u0103rii de Amenin\u021b\u0103ri este utilizat\u0103 pentru a c\u0103uta proactiv ac\u021biuni mali\u021bioase \u0219i comportamente anormale \u00een sistem pentru a investiga ulterior un poten\u021bial eveniment de securitate. Sec\u021biunea C\u0103utarea de Amenin\u021b\u0103ri din Management Platform permite c\u0103utarea evenimentelor cu parametrii specifica\u021bi \u00een datele ma\u0219inii utilizatorului.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/su\/2p\/l5\/su2pl5rwsc32slfnokqn_rrqtus.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/3f771fbea121a78d1d50daf42f1643cb.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Instrumentul C\u0103ut\u0103rii de Amenin\u021b\u0103ri are mai multe interog\u0103ri predefinite, de exemplu: pentru clasificarea domeniilor sau fi\u0219ierelor mali\u021bioase, urm\u0103rirea acces\u0103rilor rare c\u0103tre anumite adrese IP (\u00een raport cu statistica general\u0103). Structura interog\u0103rii const\u0103 din trei parametri: <i>un indicator<\/i> (protocol de re\u021bea, identificator de proces, tip de fi\u0219ier etc.), <i>operator<\/i> (\u201eeste\u201d, \u201enu este\u201d, \u201einclusiv\u201d, \u201eunul dintre\u201d etc.) \u0219i <i>corpul interog\u0103rii<\/i>. \u00cen corpul interog\u0103rii pot fi utilizate expresii regulate, fiind sus\u021binut\u0103 utilizarea simultan\u0103 a mai multor filtre \u00een linia de c\u0103utare.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/1y\/3c\/2a\/1y3c2acosy5e22pturoe7khfchq.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/c0070db473264069eda4f07a919eaa8c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Dup\u0103 alegerea filtrului \u0219i finalizarea proces\u0103rii cererii, se ob\u021bine acces la toate evenimentele corespunz\u0103toare, cu posibilitatea de a vizualiza informa\u021bii detaliate despre eveniment, de a plasa obiectul cererii \u00een carantin\u0103 sau de a genera un raport detaliat Forensics Report cu descrierea evenimentului. \u00cen prezent, acest instrument se afl\u0103 \u00een versiune beta \u0219i se preconizeaz\u0103 extinderea setului de func\u021bionalit\u0103\u021bi, de exemplu, ad\u0103ugarea de informa\u021bii despre eveniment sub form\u0103 de matrice Mitre Att&amp;ck.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/i8\/uh\/ck\/i8uhckgoeakoqcbd7nqx1btijac.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/61c9043715428af9cbd90bd49e679ce3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Concluzie<\/h3>\n<p>\nS\u0103 tragem concluzii: \u00een acest articol am analizat posibilit\u0103\u021bile de monitorizare a evenimentelor de securitate \u00een SandBlast Agent Management Platform, am studiat noul instrument pentru c\u0103utarea proactiv\u0103 a ac\u021biunilor mali\u021bioase \u0219i anomaliilor pe ma\u0219inile utilizatorilor \u2014 Threat Hunting. Urm\u0103torul articol va fi finalul acestui ciclu \u0219i \u00een acesta vom r\u0103spunde la cele mai frecvente \u00eentreb\u0103ri referitoare la Management Platform \u0219i vom discuta despre posibilit\u0103\u021bile de testare ale acestui produs.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/358508\/\">O selec\u021bie mare de materiale despre Check Point de la TS Solution<\/a><\/noindex>. Pentru a nu pierde urm\u0103toarele publica\u021bii pe tema SandBlast Agent Management Platform \u2014 urm\u0103ri\u021bi actualiz\u0103rile pe re\u021belele noastre sociale (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blogul TS Solution<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/zen.yandex.ru\/id\/5c7d2162fa818600ae386a52\">Yandex.Zen<\/a><\/noindex>).<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/516336\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u044f\u0442\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u0446\u0438\u043a\u043b\u0430 \u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Check Point SandBlast Agent Management Platform. \u0421 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0441\u0442\u0430\u0442\u044c\u044f\u043c\u0438 \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f, \u043f\u0435\u0440\u0435\u0439\u0434\u044f \u043f\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0441\u044b\u043b\u043a\u0435: \u043f\u0435\u0440\u0432\u0430\u044f, \u0432\u0442\u043e\u0440\u0430\u044f, \u0442\u0440\u0435\u0442\u044c\u044f, \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0432 Management Platform, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u043b\u043e\u0433\u0430\u043c\u0438, \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u0430\u043c\u0438 (View) \u0438 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0435\u043c \u0442\u0435\u043c\u0443 Threat Hunting \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92914,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92913","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logs, Reports &amp; Forensics. Threat Hunting | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-01T11:42:56+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-01T11:42:56+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Jurnale, Rapoarte \u0219i Informa\u021bii Criminalistice. Threat Hunting | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logs, Reports &amp; Forensics. Threat Hunting | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-01T11:42:56+00:00","article:modified_time":"2020-09-01T11:42:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92913","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:58:25","updated":"2022-09-30 07:34:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/92913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=92913"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/92913\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/92914"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=92913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=92913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=92913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}