Subscribe to the Blog

Get articles sent directly to your inbox.

This is a real life sample alert from Indeni


The Stateful Inspection feature on this firewall has been disabled. Since Stateful Inspection is a core element of the behavior of modern firewalls, this may mean a severe security gap exists. For more information, read Why Turning Off Stateful Inspection On Your Check Point Firewall Is Bad on Hurricane Labs’ website.

This signature has been made possible with the help of Lindsay Hill.

Manual Remediation Steps:

Re-enable Stateful Inspection under Global Parameters. Be careful when doing so as it may break traffic that was allowed previously.

How does this alert work?

indeni connects to the servers managing the Check Point firewalls (SmartCenter / Security Management / Provider-1 / MDM) and parses the policy files (such as objects_5_0.C). It looks for the flag for the stateful inspection and if it’s false, alerts.

BlueCat acquires Indeni to boost its industry-leading DNS, DHCP and IP address management platform to help customers proactively assess network health and prevent outages.