In This Section: |
Check Point ThreatCloud is a dynamically updated service that is based on an innovative global network of threat sensors and organizations that share threat data and collaborate to fight against modern malware. Customers can send their own threat data to the ThreatCloud and benefit from increased security and protection and enriched threat intelligence. The ThreatCloud distributes attack information, and turns zero-day attacks into known signatures that the Anti-Virus Software Blade can block. The Security Gateway does not collect or send any personal data.
Participation in Check Point information collection is a unique opportunity for Check Point customers to be a part of a strategic community of advanced security research. This research aims to improve coverage, quality, and accuracy of security services and obtain valuable information for organizations.
The ThreatCloud repository contains more than 250 million addresses that were analyzed for bot discovery and more than 2,000 different botnet communication patterns. The ThreatSpect engine uses this information to classify bots and viruses.
For the reputation and signature layers of the ThreatSpect engine, each Security Gateway also has:
Access the ThreatCloud repository from:
Data which Check Point Collects
When you enable information collection, the Check Point Security Gateway collects and securely submits event IDs, URLs, and external IPs to the Check Point Lab regarding potential security risks.
For example:
<entry engineType="3" sigID="-1" attackName="CheckPoint - Testing Bot" sourceIP="7a1ec646fe17e2cd" destinationIP="d8c8f142" destinationPort="80" host="www.checkpoint.com" path="/za/images/threatwiki/pages/TestAntiBotBlade.html" numOfAttacks="20" />
This is an example of an event that was detected by a Check Point Security Gateway. It includes the event ID, URL, and external IP addresses. Note that the data does not contain confidential data or internal resource information. The source IP address is obscured. Information sent to the Check Point Lab is stored in an aggregated form.
To configure the Security Gateway to share information with the Check Point ThreatCloud:
The gateway window opens and shows the General Properties page.
The Anti-Bot and Anti-Virus page opens.
Note - These settings are not relevant when you use the ThreatCloud emulation service, because with this service, the files are already sent to the ThreatCloud service for emulation.
The Threat Emulation page opens.
The IPS page opens.
By default, all gateways send threat information to the ThreatCloud.
You can change this default behavior in SmartConsole.
To configure all gateways not to send information to the ThreatCloud:
You can change the default automatic schedule for when updates are automatically downloaded and installed. If you have Security Gateways in different time zones, they are not synchronized when one updates and the other did not yet update.
To configure Threat Prevention scheduled updates:
The Scheduled Update window opens.
ThreatCloud Intellistore is a threat intelligence marketplace which supplements ThreatCloud and provides intelligence data from leading cyber security vendors. The data includes threat information such as IPs, domains, URLs, command and control networks, DOS attacks and more. Intellistore classifies the information feeds according to specific geographies, types of attacks or industries, and you can select the feeds that best suit your needs.
A security feed represents specialized intelligence gathered and analyzed by the vendors. ThreatCloud translates these feeds into protections which run on Security Gateways.