Email Threat Extraction - Allow and extracted anyways?

SWBW_Florian — Wed, 31 Jan 2024 06:19:01 GMT

Hi there,

i just have issues in understanding how our Checkpoint NGFW handles mails sometimes. Were using the MTA function.

one of our employees received an email with the hint that sandblast has removed some contents. There are PDF files on that mail that gets missed.

I checked the firewall log. Usually i can recover the MAIL or the FILE by those IDs through the scrub send_orig commands

I found the mentioned mail with Action "Allow". Even though there is extracted content, seen in the screenshot.

Its now allowed, or not?

If i try to resend the mail through "scrub send_orig_email {mailid} all" the mail wont get received by the employee. I get the message "Original mail was sent to "employees mail" "

Where to have a further look for this now? Can i check if the Mail really is on hold?

Thanks in Advance

Re: Email Threat Extraction - Allow and extracted anyways?

PhoneBoy — Thu, 08 Feb 2024 23:04:54 GMT

I'd start by checking the ATRG for Threat Extraction, which includes some debug steps: https://support.checkpoint.com/results/sk/sk114807

Re: Email Threat Extraction - Allow and extracted anyways?

SWBW_Florian — Mon, 04 Mar 2024 06:15:50 GMT

thanks phoneboy

i will try to work through that

topic Email Threat Extraction - Allow and extracted anyways? in Firewall and Security Management

Email Threat Extraction - Allow and extracted anyways?

Re: Email Threat Extraction - Allow and extracted anyways?

Re: Email Threat Extraction - Allow and extracted anyways?