Revision History

Added:

• Appendix H - Webhooks and Authentications
• Webhooks
• Authentications

Added:

• Alert on Generative AI Risky Session.
• Allowed Identities and Untrusted Identities lists. See Lists.

Added:

• Endpoint Security IOC Enforcement in IOC Enforcement.
• Block malicious file indicator identified by Threat Extraction Endpoint Security
• Block malicious file indicator identified by Threat Emulation Endpoint Security
• Block malicious file indicator identified by Anti-Bot Endpoint Security
• Block malicious URL indicator identified by Anti-Bot Endpoint Security
• Block malicious indicator identified by Zero Phishing Endpoint Security
• Notify on URL Reputation Identification by SASE
• Notify on Malicious File Detection by SASE
• Notify on URL filtering blocked by SASE
• Notify on Firewall Traffic Blocked by SASE
• De-isolate potentially clean Microsoft Defender machine
• Notify on AIOps alert
• Spark Management event

Updated:

• Quarantine compromised Endpoint Security device (enforced by Firewall)
• Quarantine potentially infected Endpoint Security device (enforced by Firewall)
• Quarantine potentially infected CrowdStrike device (enforced by Firewall)
• Isolate potentially infected CrowdStrike device (enforced by Endpoint)

Added:

• Isolate Endpoint device
• Isolate compromised Endpoint Security device (enforced by Endpoint)
• Isolate potentially Infected Endpoint Security device (enforced by Endpoint)
• Quarantine potentially infected Microsoft Defender device (enforced by Firewall)
• Isolate potentially infected Microsoft Defender device (enforced by Endpoint)
• Quarantine potentially infected SentinelOne device (enforced by Firewall)
• Isolate potentially infected SentinelOne device (enforced by Endpoint)
• Add malicious file indicator Identified by SentinelOne to IOC feed
• Add malicious file indicator Identified by Microsoft Defender to IOC feed
• Add malicious file indicator Identified by CrowdStrike to IOC feed

Added:

• SentinelOne
• Appendix F - Creating a SentinelOne Service User

• Added new automations:

  • Alert on MTA email bypass

  • Block attacking IP with malicious reputation identified by WAF Application Security Application Security

  • Alert if VPN Tunnel is down

  • Notify on Management validations

• Updated Block attackers upon IPS detection of popular attacks

Added:

• Automations:

  • Quarantine potentially infected CrowdStrike device (enforced by Firewall)

  • Isolate potentially infected CrowdStrike device (enforced by Endpoint)

• Appendix E - Integrating CrowdStrike Falcon

• CrowdStrike

Added:

• Automations:

  • Reset User Password in Identity Provider

  • Notify on degradation in Check Point Firewall Compliance status

• Connectors:

  • Okta

  • Microsoft Entra ID

Added note in Appendix C - Creating Workflow for Microsoft Teams Notification.

Added Appendix C - Creating Workflow for Microsoft Teams Notification

Updated:

• Notify on failure of installation of blades updates on Check Point Firewalls

• Notify on failure of Policy Installation on Check Point Firewall

• Alert on licenses expiration on Quantum device

• Alert on VPN certificates expiration on Check Point Firewall

• Notify on repeated login failures to Management

• Enforce Policy on newly discovered IoT Zone

• IoT Device is at risk

• Quarantine compromised Endpoint Security device (enforced by Firewall)

• Quarantine potentially infected Endpoint Security device (enforced by Firewall)

• Quarantine internal IP

• Notify on high rate of blocked connections

Added:

• Notify on successful installation of blade updates on Check Point Firewalls

• Notify on successful Policy Installation on Check Point Firewall

• Alert on exploit attempt detected by Endpoint Security

• Alert on ransomware attack detected by Endpoint Security

• Alert on outdated Endpoint Security Behavioral Guard capability

• Alert on malicious file detected by Endpoint Security

• Alert on a phishing attempt detected by Endpoint Security

• Alert on access to malicious site detected by Endpoint Security

• Alert on password reuse attempt detected by Endpoint Security

• Alert on the outdated Endpoint Security Static Analysis capability

• Alert on the outdated Endpoint Security Offline Reputation capability

• Alert on disconnected Endpoint Security clients

• Alert on Endpoint Security Compliance warnings

• Alert on device restrictions by Endpoint Security

• Alert on outdated Endpoint Security Anti-Malware

• Alert on Endpoint Security Anti-Malware license expiration

• Alert on Endpoint Security deployment failure

• Alert if Endpoint Security client capabilities stop running

• Alert if the device is not scanned by the Endpoint Security Anti-Malware capability

• Repeated Remote Access login failures using password-only

• Repeated Remote Access login to expired accounts

• Remote Access user login using password-only Authentication

• Block DDoS attack detected by DDoS Protector

• Open ticket

• Close ticket

• Get ticket

Added Jira Ticketing.

• Updated the procedure to attach a contract to the product in Accessing the Playblocks Administrator Portal.

• Added Endpoint Security to the list of supported products. See:

  • Introduction to Playblocks

  • On-boarding Products

• Added new automations:

  • Notify on installation of blades updates on Quantum Gateways

  • Alert on VPN certificates expiration on Quantum Gateway

  • Alert if no communication with Quantum Gateway

  • Notify on Endpoint Security client uninstall password change

  • Notify on bulk uninstallation of Endpoint Security clients

  • Stop and quarantine file via Microsoft Defender

  • Scan machine via Microsoft Defender

• Added Microsoft Defender

Rebranded Horizon Playblocks to Playblocks.

Added new automations:

• Notify on repeated login failures to Management

• Notify on high rate of blocked connections

• Alert on licenses expiration on device

• Open ticket and notify

Added new automations:

• Block malicious IOC identified by SASE
• Block malicious indicator identified by Anti-Bot
• Block malicious indicator identified by Anti-Virus
• Block malicious indicator identified by Zero Phishing
• Block malicious indicator identified by Email Security

Updated:

• Check Point Firewall Logs
• Check Point Firewall Enforcement

Added new automations:

• Notify on Management High Availability Change-Over

• Notify on Repeated Login Failures to Management

• Scan Endpoint Security Device

First release of this document.