The AlienApp for Check Point Security Management provides deep security monitoring and response capabilities for the Check Point cloud security platform, helping safeguard critical infrastructures through early threat detection and rapid response. It enhances the threat detection capabilities of USM Anywhere by collecting and analyzing data from Check Point Security Management.
Dashboard
The Check Point AlienApp dashboard includes a consolidated view of important security events and trends, enabling the SOC operator to quickly spot unusual activities. This makes it easier to identify security trends and concerns without leaving the USM Anywhere console. Graphs and tables highlight important security data, including:
- Top failed logins by user
- Top Check Point Advisory Alerts
- Top Malware Families detected
- Top Attacks detected by Check Point
Response actions
Response actions allow the SOC to manually or automatically take an action in response to a threat. Operators can click “Action” from an alarm or event, select the action to take, and immediately block the threat. Alternatively, for well-understood alarms, operators can write orchestration rules in the USM rule engine to automatically take the same actions. Actions available include:
- Update the Check Point Firewall using URL info in an Event, or an Alarm
- Update the Check Point firewall using domain info in an Event, or an Alarm
- Update the Check Point Firewall using file hash when a response action matches an Event/Alarm
- Update the Check Point Firewall using IP when a response action rule matches an Event/Alarm
- Update the Check Point Firewall using URL when a response action rule matches an Event/Alarm
- Update the Check Point Firewall using domain info when a response action rule matches an Event/Alarm
Why you’ll love the AlienApp for Check Point
Help reduce time to detection & remediation
- Advanced security orchestration allows you to view Check Point events and alarms, through a consolidated dashboard
- Easily perform security orchestration and automated response (SOAR) actions
- Data enrichment and analytics help you capture, analyze, visualize, and respond to threats on your Check Point platform