topic Re: How to download an attachment removed by checkpoint? in Firewall and Security Management

How to download an attachment removed by checkpoint?

jnoble — Wed, 08 Apr 2020 20:41:11 GMT

Hi,

One of our users received an email with .mp3 extension from our client and the attachment was removed by checkpoint.

Is there a way to retrieve it?

Thanks.

PhoneBoy — Thu, 09 Apr 2020 00:51:34 GMT

If I'm not mistaken, these attachments aren't saved anywhere.
There may be hints in the log files referred to here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109699

Dilian_Chernev — Tue, 14 Apr 2020 09:36:53 GMT

Open the Summary report from logs and download it from there:

Password for the archive should be: infected

jnoble — Tue, 14 Apr 2020 11:42:07 GMT

Hi Dilian,

Can you give me the steps in detail?

Is there a built in summary report?

Thanks.

Dilian_Chernev — Wed, 15 Apr 2020 07:02:01 GMT

Yes, for every "malicious" file there should be a Summary and Detailed per OS reports.

First locate the blocked connection in logs:

Second: open the log record and check the summary report. It is best viewed with Chrome/Firefox.

Third: will see the Summary report and can download prevented file, as on my first post.