topic ThreatEmulation in Firewall and Security Management

ThreatEmulation

Sarm_Chanatip — Thu, 26 Jul 2018 09:45:36 GMT

Hi guys,

I'm wondering if anyone here has the link download files for ThreatEmulation test. I just got Sandblast TE100X appliance in my environment and want to test if TE100X is able to detect files that unknown before and show detect/prevent on logview when file emulating completed on it.

Thank you in advance.

Regards,

Sarm

Re: ThreatEmulation

Pedro_Espindola — Thu, 26 Jul 2018 12:29:13 GMT

In ThreatWiki there is a "Test Threat Emulation" button.

Re: ThreatEmulation

Sarm_Chanatip — Thu, 26 Jul 2018 14:21:03 GMT

Hi Pedro,

It does not work. I did a live chat with someone guy of checkpoint technical support and he said that :"This is a known issue we're still working on it It needs time As for now, it is with the RnD "

Re: ThreatEmulation

Djelo_Arnautali — Thu, 26 Jul 2018 14:22:24 GMT

You can download malware files from Liste malware - malekal.com It is very difficult to get some real zero day malware files but you can test your TE100X appliance by disabling the antivirus engine and force the emulation. Check Point antivirus engine (Kaspersky) has already signatures for the files from this site so that is the reason to disable the antivirus blade.

Regards,

Re: ThreatEmulation

Sarm_Chanatip — Thu, 26 Jul 2018 14:34:29 GMT

็Hi Djelo,

That sounds good. I will try to do so.

Thank you for sharing idea.

Re: ThreatEmulation

Sven_Glock — Thu, 26 Jul 2018 17:24:04 GMT

Ask your Check Point sales engineer - he/she will have an answer

Re: ThreatEmulation

Pablo_Barriga — Mon, 30 Jul 2018 04:06:22 GMT

Hello you can try to use this tool CheckMe Instant Security Check | Check Point Software Technologies

I generates events on the TE blade.