IOC Management

IoC stands for Indicators of Compromise. These indicators arrive from various sources, such as Internet, personal research and so on. Such indicators are not identified by default and you can block them manually.

For example, if a user receives an indication that a particular URL is malicious, the user can contact their System Administrator to block access to this URL. The System Administrator tags this URL as an Indication of Compromise IoC and the policy is enforced on all the endpoints through the Harmony Endpoint client or the browser extension.

Notes: This is supported with the Endpoint Security Client Application installed on end-user computers to monitor security status and enforce security policies. version E86.20 and higher. The browser extension that can enforce the IoC policy is supported with the Endpoint Security Client version E86.50 and higher for Windows and E86.80 and higher for macOS. Files with digital signature by trusted signer is not blocked using IoC.

To configure an IoC:

1. In Infinity Portal, go to Policy > Threat Prevention.

2. In the toolbar, select Manage IoC. No need to install policy.

3. In the table that appears, manually add new Indicators of Compromise by type:

   IoC Type	Example
   Domain	checkpoint.com
   IP Address	192.168.1.1
   URL	checkpoint.com/test.htm
   MD5 Hash	2eb040283b008eee17aa2988ece13152
   SHA1 Hash	510ce67048d3e7ec864471831925f12e79b4d70f

4. Hover over the icon next to Type to view the capabilities required for each type:

   • URL, Domain and IP require Anti-Bot Check Point Software Blade on a Security Gateway that blocks botnet behavior and communication to Command and Control (C&C) centers. Acronyms: AB, ABOT. and URL Filtering Check Point Software Blade on a Security Gateway that allows granular control over which web sites can be accessed by a given group of users, computers or networks. Acronym: URLF. capabilities.

   • SHA1 and MD5 Hashes require Threat Extraction Check Point Software Blade on a Security Gateway that removes malicious content from files. Acronym: TEX. and Threat Emulation Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE. capabilities.

5. The user can also upload his own manually-created CSV list of indicators.

6. To verify, on the endpoint, access the IoC (for example, a URL). The system blocks the access to the IoC.