topic Re: sandbox TE1000X in Firewall and Security Management

sandbox TE1000X

Dariusz_Puzynow — Fri, 22 Dec 2017 06:54:28 GMT

Have this kind appliance some of Kaspersky antivirus engine ? If Yes, can we uninstall this part ?

Re: sandbox TE1000X

Thomas_Werner — Wed, 27 Dec 2017 16:55:47 GMT

Hi Dariusz,

Check How to disable and remove Kaspersky Labs components from Check Point Security Gateway

There are also TE specific notes.

Regards Thomas

Re: sandbox TE1000X

Olga_Kuts — Wed, 03 Jan 2018 07:38:15 GMT

Hi Thomas,

This question also interests me. The sk has only notes for endpoint clients with an Ant-Malware blade, but there is nothing about the sandblast appliance. Do we need to install a fix if we use sandblast agents and a local sandblast appliance TE1000X?

Re: sandbox TE1000X

Maria_Pologova1 — Sun, 07 Jan 2018 13:46:59 GMT

Hi Olga,

Looks like in your message you're referring to another sk - How to disable and remove Kaspersky Labs components from Check Point Endpoint Anti-Malware Blade.

I believe, the second section in the sk118539 is exactly what you are looking for - Action plan for versions R77.30 and above (Disable & Remove).

You need to install Check Point <VERSION> Hotfix for sk118539 (Kaspersky Anti-Virus Removal) as in picture below.

Re: sandbox TE1000X

Thomas_Werner — Fri, 26 Jan 2018 11:54:36 GMT

Hi Olga,

Sorry for the delayed answer.

The procedure mentioned for Kaspersky removal in sk118539 will also remove Kaspersky from the Threat Emulation (Sandbox) part. Please remember that after Kaspersky removal AV malware detection on our gateways will still work at the same security level/detection rate but without involving Kaspersky components anymore. So there is no security impact !

So to summarize:

For existing R80.10/R77.30 installations there is a CPUSE package to remove Kaspersky (Check Point <VERSION> Hotfix for sk118539 (Kaspersky Anti-Virus Removal) )
For new R80.10 installations there is a dedicated ISO without Kaspersky components (R80.10 image Take 462 or higher)
For Endpoint Anti-Malware you can disable the AV blade (How to disable and remove Kaspersky Labs components from Check Point Endpoint Anti-Malware Blade ) but we plan to have an endpoint AV blade not related to Kaspersky in the near future

Regards Thomas