The AlienApp for Check Point provides a set of orchestration actions that you can use to identify and categorize items to send to your firewallVirtual or physical device designed to defend against unauthorized access to data, resources, or a private network. A firewall’s primary purpose is to create segregation between two or more network resources, blocking undesirable traffic between them. as a response to threats identified by USM Anywhere.

As USM Anywhere surfaces eventsAny traffic or data exchange detected by AT&T Cybersecurity products through a sensor or external devices such as a firewall., vulnerabilities, and alarmsAlarms provide notification of an event or sequence of events that require attention or investigation., your team determines which items require a response action. Rather than manually tagging threats, you can use the AlienApp for Check Point orchestration actions to enforce protection based on the information associated with the event or alarm. The following table lists the available actions from the AlienApp.

Actions for the AlienApp for Check Point

Action
Add a threat indicator using a destination IP address
Add a threat indicator using a source IP address
Add a threat indicator using a destination domain
Add a threat indicator using a source domain
Add a threat indicator using a file hash
Add a threat indicator using a URL
Tag a destination IP address from an alarm, event, or rule in the user interface (UI)
Tag a source IP address from an alarm, event, or rule in the UI

To view information about these actions in USM Anywhere

1. In USM Anywhere, go to Data Sources > AlienApps.
2. Click the Available Apps tab.
3. Search for the AlienApp, and then click the tile.
4. Click the Actions tab to display information for the supported actions.
5. Click the History tab to display information about the executed orchestration actions.

Launch Actions from USM Anywhere

You can launch an action directly from alarms or events. If you want to apply an action to similar events that occur in the future, you can also create orchestration rules directly from the action applied to an alarm or event.

To launch a Check Point orchestration action for an alarm

1. Go to Activity > Alarms or Activity > Events.
2. Click the alarm or event to open the details.

3. Click Select Action.

4. In the Select Action dialog box, select the Check Point tile.

5. For the App Action, select the action you want to launch.

   You can launch an action to add or remove an IP address to the allowed list, add an IP address to the blocked list, or add the IP address to a custom category.

   Additional fields will be populated based on the action you've selected. Fill out the necessary fields for the app action.

6. Click Run.

   After USM Anywhere initiates the action for an alarm or event, it displays a confirmation dialog box.

   If you want to create a rule to apply the action to similar items that occur in the future, click Create rule for similar alarms or Create rule for similar events and define the new rule. If not, click OK.