Check Point HARMONY R81 - Manual Analysis with Push Operations

Manual Analysis with Push Operations
R81 Harmony Endpoint Server Administration Guide|324
Manual Analysis with Push Operations
You can trigger incident analysis for a client on a one-time basis with Push Operations. You
can run the Push Operations from SmartEndpoint or from the CLI. The analysis occurs without
the need to install policy.
To use Forensics Push Operations from SmartEndpoint:
1. In SmartEndpoint, right-click on a computer object and select Forensics.
2. Select an option:
n
Analyze by URL - Enter the URL to inspect.
Optional - Enter data to search for an incident that occurred.
n
Analyze by process or file - Enter the full path to the file.
Optional - Enter data to search for an incident that occurred.
3. Click OK.
The Forensics analysis runs on the users' computer.
To use Forensics Push Operations from the Endpoint Security Management Server CLI:
For complete information about a dedicated tool and integration with third party Anti-Malware
solutions, see sk105122.
Run the $UEPMDIR/system/utils/EfrPushOperation.sh script on a computer, OU, or
group.
Usage:
EfrPushOperation {-name <node_name> | -fqdn <node_FQDN> | -dn
<node_DN>} {-url <URL> |-file <file>} [-i <start_time> [-r
<range>]] [-a <activity_event>] [-c <case_analysis_event>] -u
<username> -p <password>
Parameters:
Parameter Description
-name <node_
name>
The requested node name as appears in SmartEndpoint
-fqdn <node_
FQDN>
The requested node FQDN name (for example,
device1@mycompany.com)