* Check Point next month releases Eventia Analyzer
Check Point next month will release a security-event management tool that’s designed to be configured and deployed more easily than software made by vendors that specialize in event-correlation software. This is assuming that the tool is installed on a network using Check Point VPNs or other security gear.
The platform, called Eventia Analyzer, looks through a library of predefined security events so customers don’t have to create profiles for each threat that may come to light. Such events include port scans, denial-of-service attacks and brut-force attacks.
The software gathers data from other Check Point products that may be on the network, including SmartCenter and Provider-1 management consoles, VPN-1 gateways, Interspect LAN security software and Connectra SSL VPN appliances, and sorts the information to isolate specific threats. It can also gather data from the logs of other vendors’ product including Cisco firewalls, routers and switches; Juniper firewalls, routers and switches; Unix-based equipment; intrusion detection systems and Apache Web servers.
Based on policies set by users, Eventia responds with alerts or automated responses such as shutting a firewall port. The tool can also generate six categories of reports based on the data it correlates: attack severity, attack activities, worm activities, host-based events, external events by service and internal events by service.
Eventia will ship in March and pricing starts at $18,000 for 10 devices reporting, and up to $100,000 for more than 40 devices.
Check Point is also upgrading its Integrity software that checks whether remote computers are configured to meet corporate security policies before the machines are granted VPN access. The software now supports an optional service called Program Adviser, which taps a Check Point database of 85,000 applications – most of them known malware – to see whether new applications found running on computers pose a threat.
It also includes Malicious Code Protector that renders malicious code harmless when it tries to execute on a machine. Later this year, Check Point will add its Application Intelligence and Web Intelligence software to Integrity to create intrusion protection for individual computers.
Other vendors – Cisco, McAfee, CSA among them – offer such software but Check Point says it products are less complex. The tools are also less comprehensive, but Check Point says that is a tradeoff with ease of use.
Pricing for the new Integrity features has not been set.
