Serious Discussion Harmony Endpoint by Check Point

[Xeno1234]

With Harmony (Kaspersky detection - PDM)

View attachment 276564

Was this detected by like a static scan or was it detected after it was ran behaviorally cause PDM is System Watcher for Kaspersky

 

[Shadowra]

Was this detected by like a static scan or was it detected after it was ran behaviorally cause PDM is System Watcher for Kaspersky

After execution

 

[Xeno1234]

After execution

so it was detected behaviorally, cool to know Harmony has System Watcher AND its own behavioral detection which is INSANE

 

[Xeno1234]

Also Trident can you export your policy so I can use it, or is that not how it works?

 

[Shadowra]

A trojan that SentinelOne missed in my test.
Kaspersky doesn't detect it, but blocks the malware anyway! (in PDM detection and CheckPoint detection)

 

[Xeno1234]

A trojan that SentinelOne missed in my test.
Kaspersky doesn't detect it, but blocks the malware anyway! (in PDM detection and CheckPoint detection)

View attachment 276926View attachment 276927

Wdym Kaspersky doesnt detect it - System Watcher got it which is Kaspersky's Behavioral blocker.

 

[Kongo]

Wdym Kaspersky doesnt detect it - System Watcher got it which is Kaspersky's Behavioral blocker.

Kaspersky didn't have a signature for the sample probably

 

[Shadowra]

Wdym Kaspersky doesnt detect it - System Watcher got it which is Kaspersky's Behavioral blocker.

I know that PDM detections are Kaspersky's System Watcher
Kaspersky has no detection on the sample. I sent it.

 

[Xeno1234]

I know that PDM detections are Kaspersky's System Watcher
Kaspersky has no detection on the sample. I sent it.

Oh you meant signature, my bad. I thought you also ment behaviorally aswell.

 

[Xeno1234]

Also since Checkpoint uses Kaspersky's Engine, does it utilize their disinfection technology?

 

[Trident]

Also since Checkpoint uses Kaspersky's Engine, does it utilize their disinfection technology?

No, it doesn't. All engines are just plug-ins to the forensics engine and this is the one that provides disinfection. For Kaspersky disinfection, I suggest you install Kaspersky and stop going off-topic on this thread. This thread is not about Kaspersy and it is not suitable for Kaspersky fanboys.

 

[Xeno1234]

No, it doesn't. All engines are just plug-ins to the forensics engine and this is the one that provides disinfection. For Kaspersky disinfection, I suggest you install Kaspersky and stop going off-topic on this thread. This thread is not about Kaspersy and it is not suitable for Kaspersky fanboys.

Sorry - I was just wondering. I'm not sure which one I want to pick since both are great options - the only thing driving me away from checkpoint is the extension just makes thing take forever to download.

 

[Trident]

Sorry - I was just wondering. I'm not sure which one I want to pick since both are great options - the only thing driving me away from checkpoint is the extension just makes thing take forever to download.

So the choice is clear. Go with Kaspersky.

 

[Xeno1234]

I might give Checkpoint another chance, but if I dont like it I'll go back to Kaspersky.

 

[Xeno1234]

My only question is if I ever decide too, how do I disable the browser extension.
Actually: I made it Suspend Download until Threat Emulation Completes and I personally think this works for me. It doesnt take forever to download things anymore. I think now I might stick with checkpoint now

 

[Xeno1234]

Just out of curiosity - it takes around 2-3 minutes to download a unknown file as its emulating, right? It was a bit faster earlier going for some files around 30 seconds but now its around 2-3 mintues.

 

[Trident]

Just out of curiosity - it takes around 2-3 minutes to download a unknown file as its emulating, right? It was a bit faster earlier going for some files around 30 seconds but now its around 2-3 mintues.

Dude we got it, stop spamming. You flooded the thread with your useless posts. I don’t wanna see anymore posts from you here, ok?

 

[NormanF]

No, it doesn't. All engines are just plug-ins to the forensics engine and this is the one that provides disinfection. For Kaspersky disinfection, I suggest you install Kaspersky and stop going off-topic on this thread. This thread is not about Kaspersy and it is not suitable for Kaspersky fanboys.

No it isn't but until recently Checkpoint/ZoneAlarm used Kaspersky AV as its AV engine under license.

 

[Trident]

No it isn't but until recently Checkpoint/ZoneAlarm used Kaspersky AV as its AV engine under license.

And they still use third-party engine under license as part of complex architecture but they are not one of these TotalAV-like products that just license an SDK and add VPN & TuneUP on top. The third party engine serves just to provide a second opinion on files. If someone is in love with Kaspersky they don’t need to post here just to let us know. It is in the forum rules as well. They are free to post on one of the 20 Kaspersky threads they’ve already created.

 

[NormanF]

And they still use third-party engine under license as part of complex architecture but they are not one of these TotalAV-like products that just license an SDK and add VPN & TuneUP on top. The third party engine serves just to provide a second opinion on files. If someone is in love with Kaspersky they don’t need to post here just to let us know. It is in the forum rules as well. They are free to post on one of the 20 Kaspersky threads they’ve already created.

Got it. Aside from that the reason cybersecurity vendors license someone else's AV is developing an in-house engine is expensive. It may be cheaper for them to pay to use someone else's.