How to Investigate Alerts in Harmony Endpoint

Check Point Harmony Endpoint provides comprehensive alert investigation capabilities including automated forensics, threat hunting, and MITRE ATT&CK mapping. This guide walks you through investigating security alerts to identify threats, understand attack scope, and take appropriate remediation actions.

Prerequisites

Before investigating alerts, ensure you have:

• Infinity Portal access with Security Analyst or Administrator permissions
• Harmony Endpoint with Threat Hunting enabled
• Connected endpoints generating security events
• Understanding of your organization's baseline activity

Understanding the Alert Workflow

The typical investigation workflow follows these stages:

Alert Generated → Triage → Investigation → Scope Assessment → Remediation → Documentation

Accessing Alerts and Events

Navigate to the Alerts Dashboard

1. Log in to the Infinity Portal at https://portal.checkpoint.com
2. Navigate to Harmony Endpoint from the left menu
3. Click Logs & Events for the main event view
4. Or click Dashboards > Security Overview for summary metrics

Understanding Alert Severity

Alerts are categorized by severity:

Initial Alert Triage

Step 1: Review Alert Details

When an alert appears:

1. Click the alert to open details
2. Review key information:
   • Detection type: What triggered the alert
   • Affected endpoint: Computer name and IP
   • User: Logged-in user at time of detection
   • File/Process: What was detected
   • Action taken: Blocked, quarantined, or detected only

Step 2: Assess Initial Risk

Determine if immediate action is needed:

Indicators requiring immediate action:

• Ransomware detection
• Active command and control (C&C) communication
• Credential theft attempts
• Lateral movement indicators
• Data exfiltration attempts

Indicators for standard investigation:

• Potentially unwanted programs (PUPs)
• Policy violations
• Suspicious but unconfirmed activity
• User-initiated risky behavior

Step 3: Check for Related Alerts

1. Look for other alerts from the same endpoint
2. Search for alerts with similar indicators
3. Check if the same detection occurred on multiple endpoints

Deep Investigation with Forensics

Access Forensic Reports

For alerts with forensic data:

1. Click the alert to open details
2. Click View Forensic Report if available
3. The report opens showing the full attack analysis

Understanding the Forensic Report

The forensic report contains:

Attack Timeline:

• Chronological sequence of events
• Initial infection vector
• Subsequent malicious activities
• Network connections made
• Files created or modified

Process Tree:

• Parent/child process relationships
• Shows how malware executed
• Identifies injection or hijacking

Network Activity:

• Connections to external IPs
• DNS queries made
• Data transfer volumes
• Protocol analysis

File Operations:

• Files created, modified, or deleted
• Registry changes
• Persistence mechanisms

Interpreting Forensic Data

Look for these indicators:

Threat Hunting for Advanced Investigation

Threat Hunting provides proactive search capabilities across all endpoints.

Enable Threat Hunting

If not already enabled:

1. Go to Policy > Threat Prevention > Policy Capabilities
2. Click the Analysis & Remediation tab
3. Set Enable Threat Hunting to On
4. Click Save & Install

Note: Threat Hunting requires Endpoint Security Client version E84.10 or higher.

Access Threat Hunting

1. Go to Threat Hunting from the Harmony Endpoint menu
2. The interface shows the search query builder and MITRE dashboard

Basic Threat Hunting Queries

Search for specific file hash:

file.sha1 = "da39a3ee5e6b4b0d3255bfef95601890afd80709"

Search for process execution:

process.name = "powershell.exe" AND process.commandline CONTAINS "-enc"

Search for network connections:

connection.remote_ip = "192.168.1.100" OR connection.remote_port = 4444

Search for file creation:

file.path CONTAINS "\\Temp\\" AND file.extension = "exe"

Using Predefined Queries

1. Click Predefined Queries in Threat Hunting
2. Browse categories:
   • Initial Access
   • Execution
   • Persistence
   • Privilege Escalation
   • Defense Evasion
   • Credential Access
   • Discovery
   • Lateral Movement
   • Collection
   • Exfiltration
   • Command and Control
3. Select a query to run
4. Review results across all endpoints

MITRE ATT&CK Dashboard

The MITRE dashboard maps all observed activity to the ATT&CK framework:

1. Click MITRE ATT&CK in Threat Hunting
2. View the matrix showing observed techniques
3. Colored cells indicate detected activity:
   • Red: Malicious confirmed
   • Orange: Suspicious
   • Yellow: Anomalous
4. Click a technique for details and related queries
5. Drill down to specific events

Investigating Specific Threat Types

Malware Investigation

1. Identify the malware family from detection name
2. Find the initial infection vector:
   • Email attachment
   • Web download
   • USB drive
   • Network share
3. Map the attack chain:
   • Initial execution
   • Persistence mechanisms
   • Payload delivery
   • Lateral movement attempts
4. Check for additional infections:
   • Search for file hash across endpoints
   • Look for similar behavior patterns

Ransomware Investigation

1. Immediate containment:
   • Isolate affected endpoint
   • Block network communication
2. Assess encryption scope:
   • Review file operations in forensics
   • Check for encrypted file extensions
   • Identify targeted directories
3. Check anti-ransomware protection:
   • Verify backup snapshots exist
   • Plan restoration if needed
4. Identify strain and attack vector:
   • Note ransom message details
   • Research specific ransomware family
   • Report to law enforcement if required

Credential Theft Investigation

1. Identify theft method:
   • Memory scraping (Mimikatz-style)
   • Keylogging
   • Browser credential access
   • Network credential sniffing
2. Determine affected accounts:
   • Review process access to credential stores
   • Check LSASS process access
   • Identify impacted users
3. Remediation:
   • Force password resets
   • Revoke sessions
   • Enable MFA if not already active

Lateral Movement Investigation

1. Map affected systems:
   • Review network connections
   • Check authentication events
   • Identify accessed resources
2. Identify movement technique:
   • PsExec or similar tools
   • WMI execution
   • Remote services
   • Pass-the-hash/ticket
3. Contain spread:
   • Isolate compromised endpoints
   • Block identified C&C
   • Reset compromised credentials

Taking Remediation Actions

Isolate Endpoint

Disconnect a compromised endpoint from the network:

1. In the alert or Asset Management, select the endpoint
2. Click Actions > Isolate
3. The endpoint can only communicate with Check Point cloud
4. Investigate and remediate while isolated
5. Click Un-isolate when safe to reconnect

Terminate Process

Stop a malicious process:

1. In Threat Hunting results or alert details
2. Select the malicious process
3. Click Actions > Terminate Process
4. Confirm the action
5. Process is killed on the endpoint

Quarantine File

Move a malicious file to quarantine:

1. In alert details or Threat Hunting
2. Select the file (by path or hash)
3. Click Actions > Quarantine File
4. File is moved to secure quarantine
5. Access quarantine in Asset Management > Quarantine

Trigger Forensic Analysis

Collect detailed forensic data on demand:

1. Select the endpoint or specific event
2. Click Actions > Trigger Forensic Analysis
3. Wait for data collection (may take several minutes)
4. Review generated forensic report

Block IOC Across Environment

Prevent indicator from executing on any endpoint:

1. In alert details, identify the IOC (hash, domain, IP)
2. Click Actions > Block IOC
3. Select IOC type and value
4. Block applies to all connected endpoints
5. Monitor for additional detections

Creating Investigation Reports

Export Alert Data

1. In Logs & Events, filter to relevant alerts
2. Click Export
3. Select format (CSV, PDF, or JSON)
4. Include forensic data if available
5. Save for documentation

Generate Incident Report

For formal incident documentation:

1. Go to Reports > Create Report
2. Select Incident Report template
3. Include:
   • Executive summary
   • Timeline of events
   • Affected systems
   • IOCs discovered
   • Remediation actions taken
   • Recommendations
4. Export in desired format

Best Practices for Alert Investigation

Investigation Efficiency

Common Investigation Mistakes

Integrating with External Tools

SIEM Integration

Export alerts to your SIEM for correlation:

1. Go to Settings > Integrations
2. Configure syslog or API export
3. Map Check Point fields to SIEM schema
4. Create correlation rules in SIEM

SOAR Integration

Automate investigation and response:

1. Configure API access for your SOAR platform
2. Create playbooks for common alert types
3. Automate enrichment (VirusTotal, WHOIS, etc.)
4. Orchestrate response actions

Troubleshooting Investigation Issues

No Forensic Data Available

Solutions:

1. Verify Forensics is enabled in policy
2. Check endpoint client version supports forensics
3. Ensure endpoint was online during incident
4. Trigger manual forensic collection

Threat Hunting Returns No Results

Solutions:

1. Verify Threat Hunting is enabled
2. Check query syntax
3. Expand time range
4. Verify endpoints are reporting data
5. Check region compatibility

Slow Query Performance

Solutions:

1. Narrow time range
2. Add more specific filters
3. Use indexed fields when possible
4. Run complex queries during off-peak hours

Next Steps

After investigating alerts:

1. Update policies based on findings
2. Add exclusions for legitimate false positives
3. Share IOCs with threat intelligence platforms
4. Conduct lessons learned for major incidents
5. Train team members on new threat patterns

Additional Resources

• Harmony Endpoint Threat Hunting Guide
• Analysis & Remediation Documentation
• MITRE ATT&CK Framework
• Check Point Research Threat Intelligence
• Check Point CheckMates Community

Need help investigating security incidents? Inventive HQ offers incident response services backed by Check Point certified engineers. Contact us for rapid response assistance.