topic Re: Use Sandblast API on Security Gateway in API / CLI Discussion

Use Sandblast API on Security Gateway

Jan_Kleinhans — Wed, 27 Feb 2019 15:37:45 GMT

Hello,

we would like to create a webpage to let internal administrators test files against the Checkpoint Thread Emulation API.

We have NGTX License for our Gateway so I think it should be possible. We want to use the ThreadCloud. This is already working on the gateway (80.20).

I followed the guide to enable the API (sk113599) but I have no optin in SmartDashboard to Enable the API and if we open https://<IP_Address_of_Security_Gateway>/UserCheck/TPAPI

it says

Not Found

The requested URL /TPAPI was not found on this server.

Can the API not be used with Threadcloud from a NGTX Gateway?

Best Regards,

Jan

Re: Use Sandblast API on Security Gateway

PhoneBoy — Thu, 28 Feb 2019 02:10:11 GMT

You can only enable the API on a Threat Emulation appliance.

Otherwise, you can make API calls against the ThreatCloud, which you have access to as a result of having an NGTX Subscription.

Re: Use Sandblast API on Security Gateway

Jan_Kleinhans — Thu, 28 Feb 2019 06:20:55 GMT

Hello,

thank you for the quick answer. How can I use the Threadcloud API. Is there any SK or Howto ?

Thanks,

Jan

Re: Use Sandblast API on Security Gateway

PhoneBoy — Thu, 28 Feb 2019 22:04:23 GMT

It's described in the Threat Prevention API 1.0 Reference Guide

The only real difference is:

The endpoint used
You need to include an API key in the request (not required for a local appliance)

Re: Use Sandblast API on Security Gateway

Jan_Kleinhans — Fri, 01 Mar 2019 06:43:55 GMT

Do I have to open a case to get the API Key or how to get it?

Re: Use Sandblast API on Security Gateway

PhoneBoy — Sat, 02 Mar 2019 00:10:30 GMT

As I'm looking into this, it appears you may need a specific license to call the Cloud API directly.

You can generate an evaluation license for it under Product Evaluation > Other Evaluation Option > Threat Emulation > Threat Emulation Cloud API (CPCS-TE-API-A-EVAL-SOC).

Inside the Eval License, you then have the option to generate one or several API Authorization keys.

To acquire said license on a permanent basis, consult your local office.