topic Sandblast Appliance connects to webex server ? in Firewall and Security Management

Sandblast Appliance connects to webex server ?

dinhnv — Mon, 24 Aug 2020 03:04:21 GMT

Dear all,

i am facing with situation that i do not make sure why does it happen ?

On SmartCenter, i can see TE appliance connects to webex server, it is detected by Firewall Core.

i would like to know, Why does it happen ?

Re: Sandblast Appliance connects to webex server ?

PhoneBoy — Wed, 26 Aug 2020 19:58:45 GMT

Are you using Threat Emulation in MTA mode?
My guess is the gateway received a mail with a WebEx link and it's checking it.
In addition to emulating the link when received, links can be scanned at click-time with a new feature: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk162618

Re: Sandblast Appliance connects to webex server ?

dinhnv — Thu, 27 Aug 2020 04:11:15 GMT

Hi,

Thank you for your reply

Are you using Threat Emulation in MTA mode? Yes, TE in MTA mode.

My guess is the gateway received a mail with a WebEx link and it's checking it. I think so, but on log GUI, i cannot find any alert about that link is attached an email, one more, Links inside mall feature is disabled.

do you have any idea for this situation ?

Re: Sandblast Appliance connects to webex server ?

PhoneBoy — Thu, 27 Aug 2020 04:14:24 GMT

Suggest a TAC case here.