Using Threat Hunting


Item	Description
1	Last Day - Time filter for the query. Users can choose between Last Day, Last 2 Days, Last Week and a Custom time period.
2	Process - Refine your query results according to the activity type.
3	Let the hunt begin - Click + and define the values to search in the logs. You can add multiple values and fields at a time.
4	Menu for predefined queries.
5	Predefined - Check Point's predefined queries, divided by category. Note: Leads in Detections, Leads and Alerts are lead detections or signatures. If an incident is raised under this category, the term Lead. is prefixed to its protection name. For example, Lead.Win.BrwsrPassThft.B. It does NOT indicate an attack and we recommend that you ignore these incidents. This is used by Check Point to analyze if a protection has to be developed. For example, create a new signature.
6	MITRE ATT&CK - Shows the MITRE ATT&CK framework of tactics and techniques. Each technique includes one or more queries, pre-defined by Check Point Research.
7	Bookmarks - Shows the custom queries saved as bookmarks, either as global (available for all users in the account) or private (available only for the user). Users can also define email notifications for these saved queries, currently limited to 10. For more information, see Saving a Query as a Bookmark.
8	History - See all the queries that you used.
9	Settings - Change the UI look and feel.

To hunt for threats, you can use predefined queries or by proactively creating your own queries.

To use predefined queries:
1. Go to Predefined Hunting Queries or
  
  Click the icon next to the search box and select Predefined.
  
  You can quickly find all active attacks and browse through different malicious events detected by Endpoint clients.
2. Click the icon next to the search box and select MITRE ATT&CK.
  
  The MITRE ATT&CK dashboard provides real-time visibility on all the techniques observed by Endpoint Security across your endpoints. It maps all raw events to MITRE Tactics, Techniques, and Procedures (TTPs) regardless of status.
  
  The MITRE ATT&CK dashboard is divided into 12 categories and each category is a stage in an attack. Each category includes multiple attack techniques.
  
  When you click a technique, a window opens with an explanation about the technique and a list of predefined queries. Run a query to get a list of the events in which the specific technique implementation was used.
To search for specific events by proactively creating your own queries:
1. Go to Threat Hunting.
2. Click the + sign next to Let the hunt begin.
3. From the Indicator list, select the filter.
4. From the Operator list, select the condition.
5. In the Add a single value field, enter a value for the indicator.
6. Click Add.
  
  It shows the search results in a timeline. The timeline provides behavioral insights that indicate anomalies or attacks.
7. To add another filter to the same query, repeat steps 2 to 6.
  
  Note:
  If you have multiple filters, the system applies the logical AND operator between the filters.
8. To filter events based on the timeline, click the required hexagon.
  
  It shows detailed information about the event, together with intelligent enrichment, such as attack classification, malware family and MITRE technique details.
9. To create a bookmark for a query, see Saving a Query as a Bookmark.
10. You can also filter the results by date and process.
11. To take remediation action for the filtered results, click Actions and choose any of these:
  - Terminate Process
  - Quarantine File
  - Trigger Forensic Analysis
  - Isolate Machine
12. To export the results to a CSV file, click Actions > Export to CSV.

Saving a Query as a Bookmark

Create a add-filters-to-custom-query.dita.
Click from the top right corner of the page.

The Create Shared/Private Bookmark pop-up appears.
To make the bookmark public, select Shared - available to all system users.
To make the bookmark private, select Private - available only to you.
In the Name field, enter a query name.
From the Importance list, select an importance level for the query detection.
In the Select or create tag name field, enter the tag name or select the tag name if available.

Tags create folders to store bookmarked queries.
In the Description field, enter a description for the bookmark.
To send email notifications if new activity matches the bookmarked query, select Send E-mail notifications to mailing list for any new hits checkbox.

Endpoint Security sends email notifications to the recipients added to the Threat Hunting Notifications page.
Click Save.

To add recipients to threat hunting email notifications

Go to Threat Hunting.
Click the icon next to the search box and select Notifications.
rom the Recipients list, select the users or enter the email address.

Use Case - Maze Ransomware Threat Hunting

You want to investigate the maze ransomware attack. You read about it in the internet and you are afraid it may already have infiltrated your organization.

In the MITRE ATT&CK website: Search for Maze ransomware.
From the list of techniques that Maze ransomware uses, select the applicable technique. For example: Windows Management Instrumentation
From the Check Point Portal, access Threat Hunting.
Click the icon on the right side of the search box, and go to MITRE ATT&CK.
In the MITRE ATT&CK dashboard, search for the technique you copied from the Maze website.
Click the technique to see all the events in your organization in which this technique was used.

Troubleshooting

No data available for hunting - check the following:

All prerequisites are met.
Threat Hunting is enabled in the policy.
The policy is installed on at least one working agent.
The agent with the relevant policy is connected to the management.
If the view does not load, clear the browser history and log in to the Check Point Portal again.

Known Limitations

The default data-retention period is 30 days. Longer retention requires an extended-retention license.
A proxy configured through a local .pac file is not supported. Use a web-based .pac file for the configuration.