The Check Point ThreatCloud

In This Section: Configuring Check Point ThreatCloud on a Gateway Check Point ThreatCloud Network The ThreatCloud Intellistore

Check Point ThreatCloud is a dynamically updated service that is based on an innovative global network of threat sensors and organizations that share threat data and collaborate to fight against modern malware. Customers can send their own threat data to the ThreatCloud and benefit from increased security and protection and enriched threat intelligence. The ThreatCloud distributes attack information, and turns zero-day attacks into known signatures that the Anti-Virus Software Blade can block. The Security Gateway does not collect or send any personal data.

Participation in Check Point information collection is a unique opportunity for Check Point customers to be a part of a strategic community of advanced security research. This research aims to improve coverage, quality, and accuracy of security services and obtain valuable information for organizations.

The ThreatCloud repository contains more than 250 million addresses that were analyzed for bot discovery and more than 2,000 different botnet communication patterns. The ThreatSpect engine uses this information to classify bots and viruses.

For the reputation and signature layers of the ThreatSpect engine, each Security Gateway also has:

• A local database, the Malware database that contains commonly used signatures, URLs, and their related reputations. You can configure automatic or scheduled updates for this database.
• A local cache that gives answers to 99% of URL reputation requests. When the cache does not have an answer, it queries the ThreatCloud repository.
  • For Anti-Virus - the signature is sent for file classification.
  • For Anti-Bot - the host name is sent for reputation classification.

Access the ThreatCloud repository from:

• SmartConsole - You can add specific malwares to rule exceptions when necessary. From the Threat Prevention Rule Base in SmartConsole, click the plus sign in the Protection column in the rule exceptions, and the Protection viewer opens.
• ThreatWiki - A tool to see the entire Malware database. Open ThreatWiki in SmartConsole or access it from the Check Point website.

Data which Check Point Collects

When you enable information collection, the Check Point Security Gateway collects and securely submits event IDs, URLs, and external IPs to the Check Point Lab regarding potential security risks.

For example:

<entry engineType="3" sigID="-1" attackName="CheckPoint - Testing Bot" sourceIP="7a1ec646fe17e2cd" destinationIP="d8c8f142" destinationPort="80" host="www.checkpoint.com" path="/za/images/threatwiki/pages/TestAntiBotBlade.html" numOfAttacks="20" />

This is an example of an event that was detected by a Check Point Security Gateway. It includes the event ID, URL, and external IP addresses. Note that the data does not contain confidential data or internal resource information. The source IP address is obscured. Information sent to the Check Point Lab is stored in an aggregated form.

Configuring Check Point ThreatCloud on a Gateway

To configure the Security Gateway to share information with the Check Point ThreatCloud:

1. Double-click the Security Gateway.

   The gateway window opens and shows the General Properties page.

2. Configure the settings for the Anti-Bot and Anti-Virus Software Blades.
   1. From the navigation tree click Anti-Bot and Anti-Virus.

      The Anti-Bot and Anti-Virus page opens.

   2. To configure a Security Gateway to share Anti-Bot and Anti-Virus information with the ThreatCloud, select Share anonymous attack information with Check Point ThreatCloud. To disable sharing Anti-Bot and Anti-Virus information with the ThreatCloud, clear this option.
3. Configure the settings for the Threat Emulation Software Blade.

   Note - These settings are not relevant when you use the ThreatCloud emulation service, because with this service, the files are already sent to the ThreatCloud service for emulation.

   1. From the navigation tree click Threat Emulation > Advanced.

      The Threat Emulation page opens.

   2. To configure a Security Gateway to share Threat Emulation information with the ThreatCloud, select Share anonymous attack information with Check Point ThreatCloud. To disable sharing Threat Emulation information with the Check Point cloud, clear this option.
   3. Select Share malicious files with Check Point to send malicious malware files that the Threat Emulation Software Blade identified to the ThreatCloud. To disable sending malicious files to the Check Point cloud, clear this option.
4. Configure the settings for the IPS Software Blade.
   1. From the navigation tree click IPS.

      The IPS page opens.

   2. To configure a Security Gateway to share IPS information with the ThreatCloud, select Help Improve Check Point Threat Prevention product by sending anonymous information about feature usage, infections details and product customizations. To disable sharing IPS information with the Check Point cloud, clear this option.
5. Click OK.

Check Point ThreatCloud Network

Check Point ThreatCloud is a dynamically updated service that is based on an innovative global network of threat sensors and organizations that share threat data and collaborate to fight against modern malware. Customers can send their own threat data to the ThreatCloud and receive protection updates with enriched threat intelligence.

Customers that participate in the ThreatCloud network can use the collected malware data to benefit from increased security and protection. The ThreatCloud can then distribute attack information, and turn zero-day attacks into known signatures that the Anti-Virus Software Blade can block.

When you send files to the ThreatCloud service for emulation, your network gets up-to-date threat information and operating system environments. The connection to the ThreatCloud is enabled by default. This connection gives many management features. We recommend that it be enabled. If you want to block this connection, you can change the default setting.

To block ThreatCloud:

1. From the menu bar, click Global Properties.
2. From the navigation tree, click Security Management Access.
3. In the Internet Access area, clear: Improve product experience by sending information to Check Point.
4. Publish the changes.
5. Restart SmartConsole.
6. Install the Policy.

To learn more, see sk94509.

The ThreatCloud Intellistore

ThreatCloud Intellistore is a threat intelligence marketplace which supplements ThreatCloud and provides intelligence data from leading cyber security vendors. The data includes threat information such as IPs, domains, URLs, command and control networks, DOS attacks and more. Intellistore classifies the information feeds according to specific geographies, types of attacks or industries, and you can select the feeds that best suit your needs.

A security feed represents specialized intelligence gathered and analyzed by the vendors. ThreatCloud translates these feeds into protections which run on Security Gateways.