topic Re: Speed up sandbox download in Endpoint

Speed up sandbox download

earomero — Fri, 04 Apr 2025 14:11:18 GMT

Good morning, greetings from Argentina!

Emulating downloads in the Checkpoint sandbox (Chrome extension) takes forever. A 1MB file takes about 3 minutes. It's an eternity.

I have v88.61 installed on the endpoints, and the configuration I apply is as follows:

my current configuration

I'd like to know if the sandboxing process can be sped up.

Thank you very much, best regards!

Re: Speed up sandbox download

Chris_Atkinson — Fri, 04 Apr 2025 15:10:30 GMT

This is partly the use case for why Threat Extraction or CDR exists.

End users receive sanitised documents whilst emulation occurs in the background.

Re: Speed up sandbox download

earomero — Fri, 04 Apr 2025 16:08:59 GMT

Thanks for your response.
The download is suspended until emulation is complete. The user receives the download after emulation, not before.
The problem is that this emulation takes a long time. What parameters can be configured to speed up the emulation process?
Regards!

Re: Speed up sandbox download

PhoneBoy — Fri, 04 Apr 2025 22:27:27 GMT

Beyond the file itself, there are no parameters that influence the speed of the emulation process.
Three minutes is pretty typical for that.

Re: Speed up sandbox download

Chris_Atkinson — Sat, 05 Apr 2025 02:30:48 GMT

Again talking generally, sandbox location local/remote/cloud and connectivity to it obviously can be a factor.

Out of interest is there a reason you prefer to not leverage extraction here?

Re: Speed up sandbox download

earomero — Mon, 07 Apr 2025 16:25:05 GMT

Hello, greetings from Argentina again!

The problem is that .xlsx, .docx, .pdf, and .jpg files are taking forever, and my organization's users are losing patience. I can't understand how a 3MB file takes around 4 minutes; it's an eternity in the age of IT.

Considering that the premise of my cybersecurity department is: "absolutely every download goes through sandboxing," what is recommended to speed up the emulation process?

I'll run the configuration again:

Best regards!

Re: Speed up sandbox download

PhoneBoy — Mon, 07 Apr 2025 17:51:25 GMT

I assume, given what we do with Threat Emulation, the emulation is as quick as is practical.
This includes acting on the document in the same ways an end user might.

We provide the "Get extracted copy before emulation completes" (i.e. Threat Extraction) option, which gives the end user a safe file immediately that does not include potentially unsafe/malicious elements (e.g. scripts in MS Office docs).
Once the file is emulated, if the end user needs the original, and we have not found any threats via emulation, the end user can get it.
In practice, I've only had to get the original file a handful of times over the past ~10 years.

topic Re: Speed ​​up sandbox download in Endpoint

Speed ​​up sandbox download

Re: Speed ​​up sandbox download

Re: Speed ​​up sandbox download

Re: Speed ​​up sandbox download

Re: Speed ​​up sandbox download

Re: Speed ​​up sandbox download

Re: Speed ​​up sandbox download

topic Re: Speed up sandbox download in Endpoint

Speed up sandbox download

Re: Speed up sandbox download

Re: Speed up sandbox download

Re: Speed up sandbox download

Re: Speed up sandbox download

Re: Speed up sandbox download

Re: Speed up sandbox download