topic Sandblast Emulation/Extraction work? in Firewall and Security Management

Sandblast Emulation/Extraction work?

leangm — Sat, 16 Oct 2021 06:09:59 GMT

Scenarios:

Gateway Enable threat emulation/extraction

Threat extraction: I knew that threat extraction proactive removed malicious content on file and ensure file delivery to user safe content

Threat Emulation: when gateway received unknown file send to the cloud to run on virtual sandboxing cloud

My question

1) During the step gateway send the unknown file to the cloud does the gateway keep the unknown file on its own firewall? if it keeps the unknown file on its own firewall where is the location store the unknown file in?

2) Can we monitor the progress of the file during gateway send to the cloud?

Re: Sandblast Emulation/Extraction work?

PhoneBoy — Mon, 18 Oct 2021 03:49:31 GMT

You should be able to retrieve the original file by fileid (found in the log card) using the command scrub send_orig_file.

Actually, what's happening in many cases is the URL where the file is coming from is sent to the cloud and the cloud retrieves the file directly.
In other cases (e.g MTA) the file is being uploaded from the gateway.
Believe you can monitor with tecli on the gateway.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114806&partition=Advanced&product=Threat