[New Rule] Detect Invalid Source IPs in CheckPoint Logs (SK182914 Bug)

### Description

A known issue documented by Check Point ([SK182914](https://support.checkpoint.com/results/sk/sk182914) ) causes IPS logs to show invalid or anomalous source IP addresses, for example within the 0.0.127.0/24 range.
This bug may affect environments that ingest Check Point logs (SmartEvent, Log Exporter, syslog, etc.) into Elasticsearch / Elastic Security, generating false positives or inconsistencies in dashboards, detections, and correlations.

_>Impact

Fields like source.ip or client.ip may contain invalid IP addresses.

Correlation or detection rules may be affected (false positives or ECS parsing issues).

This bug can degrade security data quality in the SIEM.

_>Rule Objective

Automatically detect Check Point IPS events with invalid or reserved source IPs associated with SK182914 to:

Trigger data quality alerts.

Allow filtering or correction (via pipeline/enrichment).

Avoid noise in threat correlation and detection.

_>>Proposed Rule (YAML)
```
rule_id: checkpoint_ips_invalid_source_ip
name: "Check Point IPS log with invalid or anomalous source IP (SK182914)"
index: ["logs-checkpoint-*", "checkpoint-*"]
type: query
description: >
Detects Check Point IPS events that show invalid or reserved source IPs, possibly related
to SK182914. This issue can lead to false positives or reduce accuracy in security correlations.
risk_score: 21
severity: low
tags: ["checkpoint", "ips", "data-quality", "sk182914", "elastic-security"]
query: >
event.module:checkpoint AND event.dataset:checkpoint.ips AND (
source.ip:("0.0.0.0" OR "0.0.127.*" OR "127.*" OR "::1") OR
NOT source.ip:*
)
fields:
- source.ip
- destination.ip
- event.id
- message
investigation_fields:
- message
- source.ip
- event.original
references:
- "https://support.checkpoint.com/results/sk/sk182914"
- "https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/R81.20/Upcoming-Resolved-Issues.htm"
author: "Elastic community – proposal by 1v4n"
```

_>Suggested Improvements

Include validation for out-of-range IP addresses (RFC 5735).

Add an optional enrichment field like invalid_ip_reason for log quality reporting.

Optionally automate temporary exclusion of these events until Check Point officially fixes the bug in future versions (R81.20+).

_>Discussion

Would it make sense to include this rule in the “data quality / network protections” package?
It could also serve as an example of vendor anomaly detection in the [elastic/detection-rules](https://github.com/elastic/detection-rules)
repository.

### Target Ruleset

network

### Target Rule Type

None

### Tested ECS Version

8.17.9

### Query

rule_id: checkpoint_ips_invalid_source_ip
name: "Check Point IPS log with invalid or anomalous source IP (SK182914)"
index: ["logs-checkpoint-*", "checkpoint-*"]
type: query
description: >
Detects Check Point IPS events that show invalid or reserved source IPs, possibly related
to SK182914. This issue can lead to false positives or reduce accuracy in security correlations.
risk_score: 21
severity: low
tags: ["checkpoint", "ips", "data-quality", "sk182914", "elastic-security"]
query: >
event.module:checkpoint AND event.dataset:checkpoint.ips AND (
source.ip:("0.0.0.0" OR "0.0.127.*" OR "127.*" OR "::1") OR
NOT source.ip:*
)
fields:
- source.ip
- destination.ip
- event.id
- message
investigation_fields:
- message
- source.ip
- event.original
references:
- "https://support.checkpoint.com/results/sk/sk182914"
- "https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/R81.20/Upcoming-Resolved-Issues.htm"
author: "Elastic community – proposal by 1v4n"

### New fields required in ECS/data sources for this rule?

_No response_

### Related issues or PRs

_No response_

### References

https://support.checkpoint.com/results/sk/sk182914

### Redacted Example Data

_No response_