topic Re: Does anyone know if there are any restrictions on scanning malicious URLs when using monitor mod in Firewall and Security Management

Does anyone know if there are any restrictions on scanning malicious URLs when using monitor mode?

ChoiYunSoo — Thu, 19 Jan 2023 12:28:29 GMT

Does anyone know if there are any restrictions on scanning malicious URLs when using monitor mode?

I am currently testing the check point e-mail security function in the internal environment in monitor mode.

Since it is a traffic mirror environment, MTA is disabled and only Threat Emulation, anti-virus, and anti-bot functions are enabled.

Functions such as file emulation are showing satisfactory test results.

However, in the case of mailcious URLs attached to e-mails, it seems that they cannot be inspected properly in Monitor mode.

As far as I know, malicious URLs should generate logs after performing reputation-based inspection.

Reputation.However, in the current test environment, no logs related to URLs are left.

It looks like it probably doesn't perform any checks.

I tested in a real environment, not a mirror environment, to check if the test URL information was incorrect.

In a real environment, I checked the normal URL inspection log as expected.

As mentioned at the beginning, if there are any restrictions when using the monitor mode in these inspection logics, please let us know.

Thanks

Re: Does anyone know if there are any restrictions on scanning malicious URLs when using monitor mod

Abigael_Levy — Thu, 19 Jan 2023 12:47:46 GMT

Hi @ChoiYunSoo

I think you are asking in the wrong board. The forum for Harmony Email & Collaboration is here: https://community.checkpoint.com/t5/Email-and-Collaboration/bd-p/cloudguard-saas.

Thanks,

Abigael

Re: Does anyone know if there are any restrictions on scanning malicious URLs when using monitor mod

_Val_ — Thu, 19 Jan 2023 13:35:43 GMT

@Abigael_Levy moved to more appropriate space

Re: Does anyone know if there are any restrictions on scanning malicious URLs when using monitor mod

Chris_Atkinson — Thu, 19 Jan 2023 15:27:45 GMT

Anything usually done by the MTA cannot be done in this case, especially if the communication is TLS encrypted.

Re: Does anyone know if there are any restrictions on scanning malicious URLs when using monitor mod

PhoneBoy — Thu, 19 Jan 2023 18:09:53 GMT

This is referring to a Quantum Security Gateway running off a Mirror Port, so unrelated to Harmony Email and Collaboration 🙂
I believe MTA mode is required for scanning malicious URLs in email.
We definitely won't see malicious URLs in SMTP traffic when running off a Mirror Port if TLS is used.
Having said that, if you're seeing Threat Emulation for documents, malicious links inside of those documents should be scanned.