Check Point + Siemplify: Challenge

Uploaded by

riyasathsafran

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

64 views

Check Point + Siemplify: Challenge

Uploaded by

riyasathsafran

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 3

Check Point and Siemplify | Solution Brief

CHECK POINT + SIEMPLIFY

THE ORCHESTRATION, AUTOMATION AND RESPONSE STACK

SOAR TO A HIGHER SOC CHALLENGE

LIFESTYLE The most pressing challenges in security operations are well known: 1) the overload
of alerts flooding the SOC, which forces teams to skip countless alerts just to keep
Benefits up, 2) the growing stack of tools used to respond to these alerts, 3) the reliance on
manual and inconsistent processes which simply cannot compete with the evolving
 Automate contextual grouping of alerts
to clean up your queue and streamline technologies used by the bad guys and 4) the shortage of talent, which makes
cross-product triage virtually all security operations teams feel understaffed and overworked.
 Run playbooks that automate away
false positives and consistently reduce SOC teams need a scalable solution that can bridge the talent gap and provide the
response times much-needed working power for a more effective SOC and a better SOC lifestyle.
 Manage and measure the success of This brief explains how this can be achieved by combining Check Point products with
your SOC from a single view with security orchestration, automation and response (SOAR) through the Siemplify
ticketing and dashboards Security Operations Platform.
 Collaborate on cases with internal and
external teams directly from the
platform THE SOLUTION
The Siemplify SOAR platform connects to your entire technology stack and provides
 Kick off with Check Point use cases
created by Siemplify power users and a single workbench for security analysts to solve threats and work side by side with
the Siemplify Community automated flows that accelerate the incident response processes.

Integration Capabilities This is demonstrated with the following use cases:

 Fusing data coming from Check Point
products onto one canvas with over 1 - AUTOMATE ALERT HANDLING AND CASE MANAGEMENT
200 additional products
Challenge
 Grouping Check Point detections with
other sources to create a single
contextual case Thanks to an increasing and often overwhelming number of threats, security stacks
are generating a massive volume of alerts and, in turn, a steady procession of
 Automating malware analysis
processes with Check Point SandBlast incident response (IR) processes. However, many organizations are still relying on
manual tasks to work through their alerts, meaning securing your organization is
 Blocking IP/URL addresses in Check
Point NGFW getting more challenging by the day.

 Automating firewall rule management

Solution
in Check Point NGFW

To handle the growing backlog of investigations, from phishing to malware to rogue

insider, a security analyst needs to go far beyond validating and blocking a specific
threat. In fact, before initiating any playbook, the Siemplify Security Operations
Platform first, and continuously, analyzes each alert as it comes into the system,
looking for contextual relationships. If a relationship is identified, the alert gets
automatically grouped with the related alerts into a case. Then, the Siemplify platform
is integrated with the Check Point Next Generation Firewall (NGFW) to automatically
block an attack on the firewall and/or disable a compromised user in the enterprise.

© 2020 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non-confidential content | March, 2020 1
Check Point and Siemplify | Solution Brief

Value

Siemplify connects the security operations center with Check Point products to streamline every step of detection and response,
replacing manual processes with automated workflows that ensure optimized triage, investigation and containment.

2 - STREAMLINE FIREWALL POLICY MANAGEMENT

Challenge

With endpoints proliferating across businesses, firewalls help control traffic based on actions configured within their policies.
Poorly implemented firewall rules can lead to major business risks. Standardizing these firewall policy actions across disparate
networks, processes and platforms poses a significant impediment for businesses with a large user population.

Solution

Playbooks running inside the Siemplify Security Operations Platform that are integrated with Check Point NGFW can be
scheduled to run at set intervals for firewall policy management. Operators can automate auditing and remediation, such as
activating a firewall rule, and workflows can tie into ticketing systems to notify administrators and track efforts.

Value

Optimizing firewall auditing and remediation to identify rules violations and analyze access policies can considerably reduce
firewall management, freeing up SOC analysts to concentrate on higher-order tasks

3 - ADVANCED MALWARE ANALYSIS AND PROACTIVE FIREWALL UPDATES

Firewall block lists need to be tight and precise to reduce false positives and security headaches. In Siemplify,
a common way to increase accuracy surrounding indicators of compromise (IOCs) is to leverage multiple
sources of threat intelligence to increase diversity of opinion and classification accuracy. But what when threat
intelligence does not have an answer?

Solution

The most abundant type of IOC is the file hash. Using advanced sandboxing technology, such as Check
Point’s Sandblast, the security team can take advantage of threat intelligence and sandboxing automatically
in a single pane of glass through Siemplify. The playbook queries SandBlast initially to see if the file already
has classification, and then if not, it detonates the file using the same integration, then finally pulls the result
and pushes it into their NGFW if it returns negative and has the option to triple check with additional sources
of threat intelligence.

Value

Through Siemplify, the security team gets the full power of Check Point SandBlast’s API to refine
intelligence surrounding files of questionable reputation, as well as the customizability of adding further
checks to 3rd party intelligence. They can automatically then maintain and update the IOC values of their
Check Point NGFW’s block lists. Additionally they can continue to automate their security processes in
Siemplify and proceed to automated remediation or other steps depending on the relevant security alert.

ABOUT SIEMPLIFY
Siemplify is the leading vendor-agnostic security operations platform globally, and is consistently chosen by world’s best security
teams, from Fortune 500 firms to global MSSPs, as their security platform of choice. Siemplify provides much more than
playbooks and automation. Based on years of expertise running and training military and civilian SOCs across the globe,
Siemplify has built a complete security operations platform that addresses the broadest set of SecOps needs. With built-in case
management, investigation, crisis management, collaboration, KPI tracking and a rich library of built-in knowledge – Siemplify is
a true workbench for analysts and engineers, and the SOC manager’s secret weapon to driving continuous improvement.

ABOUT CHECK POINT

Check Point Software Technologies Ltd. (www.checkpoint.com) is the largest network cyber security vendor globally, providing
industry-leading solutions and protecting customers from cyber attacks with an unmatched catch rate of malware and other types
of threats. Check Point offers a complete security architecture defending enterprises – from networks to mobile devices – in
addition to the most comprehensive and intuitive security management. Check Point protects over 100,000 organizations of all
sizes.