Table of Contents:
-
Introduction
-
Prerequisites
-
Configuration Procedure
-
Appendix
-
Installing Add-On on Security Management Server
-
Viewing IntelliStore Hits in the User Center
-
Purchasing/Evaluating relevant IntelliStore feeds
-
Validating Feed Licensing and Entitlement
-
Reporting False Positives or Bad Classifications
-
Testing IntelliStore Feeds
-
Related solutions
(I) Introduction
This article provides a step-by-step guide for configuring and evaluating ThreatCloud IntelliStore - a unique threat intelligence marketplace that enables organizations to select intelligence feeds that will automatically prevent cyberattacks. IntelliStore is an extension of Check Point's core security intelligence infrastructure ? ThreatCloud?, which delivers threat data from a worldwide network of threat sensors.
This article is intended for Network Administrators, using Check Point R77.20 and above.
(II) Prerequisites
- The IntelliStore is supported on Security Gateway version R77.20 and above running on Gaia OS or SecurePlatform 2.6 OS.
- Both Anti-Virus blade and Anti-Bot blade must be enabled on Security Gateway.
- (Optional) To view IntelliStore Hits in the User Center:
- R77.30 Add-On must be installed on R77.30 Security Management Server.
- R77.20 Add-On must be installed on R77.20 Security Management Server.
(III) Configuration Procedure
Configuration Procedure consists of two steps.
-
Step 1 - Installing a hotfix on Security Gateway R77.20
Note: This step applies only to R77.20.
On Security Gateway R77.20, follow the instructions in sk102649 - Security Gateway R77.20 fails to fetch new IntelliStore feeds.
-
Step 2 - Activating the feeds on Security Gateway
If you have not already purchased or evaluated IntelliStore feeds, then refer to "Appendix - Purchasing/Evaluating relevant IntelliStore feeds" section.
- Log in to the User Center.
-
Go to ASSETS/INFO tab - click on Product Center:
-
Go to the Services tab. In the left upper corner, select the relevant account:
-
Verify you have valid ThreatCloud IntelliStore feeds.
Note: If you do not have valid feeds, then refer to section "Appendix - Purchasing/Evaluating relevant IntelliStore feeds".
Example:
-
Bind the IntelliStore feed to the selected Security Gateway(s) by clicking on the feed's name.
Example:
-
Choose on which Security Gateways you would like to activate the IntelliStore feeds:
- Automatic on All Gateways
- Manual on Selected Gateways
-
Select the feed policy for the Security Gateway:
- Use Gateway Policy & Hit Analysis
- Log & Hit Analysis
- Hit Analysis
- Inactive
Note: The policy selection would affect the Security Gateway only if you have installed the Management Add-On (as described in the "Appendix - Installing Add-On on Security Management Server" section). If the Management Add-On is not installed, then the feeds will use the Security Gateway's default settings.
Policy feed selection options:
-
Click on Save button in the upper right corner.
Example:
- Repeat Steps E-G for each of the IntelliStore feeds.
- Connect with SmartDashboard to Security Management Server / Domain Management Server.
- Install the Network Security and Threat Prevention policy onto the selected Security Gateways.
- Verify the feeds have been updated on the selected Security Gateways. Refer to the "Appendix - Validating Feed Licensing and Entitlement" section.
(IV) Appendix
Appendix - Installing Add-On on Security Management Server
The Management Add-On provides the ability to integrate the User Center to the Security Gateways as well as to view IntelliStore feed hits and analysis in the User Center website. This Add-On is a prerequisite to view IntelliStore Hits in the User Center.
Follow the instructions in:
Appendix - Viewing IntelliStore Hits in the User Center
-
Install the Management Add-On as described in:
- Connect with SmartDashboard to Security Management Server / Domain Management Server.
- Open the properties of the involved Security Gateway / Cluster object.
- Go to Anti-Bot and Anti-Virus pane.
-
Check the following boxes in the Check Point ThreatCloud section:
Share anonymous attack information with Check Point ThreatCloudAllow me to view attack statistics in my User Center account
- Click on OK to apply the changes.
- Install the policy on this Security Gateway / Cluster object.
- Log in to the User Center.
-
Go to ASSETS/INFO tab - click on Product Center:
-
Go to the Services tab. In the left upper corner, select the relevant account:
- In the ThreatCloud IntelliStore line, click on the number in the Valid column.
-
Click on Show IntelliStore Hits button.
Example:
-
A resulting table will be displayed outlining the hit count from all valid feeds during the last 30 days.
Note: The hit count in the User Center may take up to 2 hours to update.
Example:
- In the resulting table, you can click any of the hit count numbers to get a detailed report of the detected malware.
-
You can also click on any one of the tabs to view analysis of the hits per severity, trend line, or to compare the different active feeds.
Example of Trend Line:
Appendix - Purchasing/Evaluating relevant IntelliStore feeds
- Log in to the User Center.
-
Go to SALES TOOLS tab - click on Product Catalog & Quoting:
-
Click on NETWORK SECURITY tab - in the section Security Cloud Services & Mobility, click on ThreatCloud IntelliStore:
-
Click on each feed, in which you are interested:
- For evaluating this feed, click on Try Now button.
- For purchasing this feed, click on Select button.
Example:
-
Make sure you select the account, in which you would like to activate the feeds.
Example:
- Once you have selected your feeds, you should be able to see them in your User Center Services section, as detailed in Step 3 above.
Appendix - Validating Feed Licensing and Entitlement
Note: It may take several minutes (up to 5) for the feeds to get updated on the Security Gateway after activating them in the User Center.
- Connect with SmartView Monitor to Security Management Server / Domain Management Server.
- In the upper right pane, select the relevant Security Gateway / cluster member.
-
In the lower pane, in the Anti-Bot & Anti-Virus section, click on More...
Example:
-
Scroll to the bottom of the displayed screen - in the lower left corner, click on ThreatCloud IntelliStore link.
Example:
-
Verify that the appropriate feeds are listed (Anti-Virus and Anti-Bot).
Example:
- For R77.20 and R77.30 only: Refer to sk104601 - Check Point ThreatCloud IntelliStore partners names mapping.
Appendix - Reporting False Positives or Bad Classifications
Each vendor is responsible for the quality and validity of his feed. If you feel events triggered are erroneous or false positives, you can report them using the following procedure:
- Connect with SmartEvent GUI to SmartEvent Server.
- Go to Threat Prevention tab.
- Locate the event you would like to report.
-
Right-click on the event - click on "Report Event to Check Point".
Example:
-
You may add any additional information, which can help the feed vendor asses your incident.
If you would like to receive updates or correspondence from the vendor, then add your e-mail address.
Example:
- Click on Send button.
You may also report a wrong classification in Check Point UserCheck screen when "Prevent" mode is configured in the appropriate policy. The UserCheck screen is visible to the end-customers who trigger an Anti-Virus or an Anti-Bot event.
Reporting a wrong classification can be performed by clicking the link as illustrated in the example below:
Appendix - Testing IntelliStore Feeds
You may use the table below to verify the IntelliStore feeds are indeed identified by the Security Gateways (through the SmartLog or SmartView Tracker).
If you have installed and configured the R77.20/R77.30 Add-On, you should be able to see the hits analysis in the User Center (allow 2 hours for hits to be presented).
The links below are harmless and do NOT include any malware.
Important Note: Make sure you have configured the feeds correctly and checked for licensing entitlement BEFORE clicking these links (refer to "Validating Feed Licensing and Entitlement" section). If you click these links before the feeds have been updated, your Security Gateway will include the test domain as benign to the Security Gateway's cache. It may take as long as 24 hours for the Security Gateway's cache to clear and re-check ThreatCloud.
|
This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.
|
Applies To:
- This SK replaces sk103878, sk104236
