topic Re: Anti-Exploit and Zero Phishing Licensing Problem in SBA in Endpoint

Anti-Exploit and Zero Phishing Licensing Problem in SBA

MikeB — Wed, 19 Aug 2020 22:47:41 GMT

Hi,

I have several customers with SBA Basic package, that according to the Product Web Page also includes Anti-Exploit / Zero Phishing / Static File analysis protections.

This features are enabled and configured with Threat Emulation and Extraction modules so we need to deploy this modules with the agent.

The problem is that in the License Report we always receive a compliance violation alert which leads to some susceptibilities and long conversations with clients.

is there anything that can be done to fix this? or some official documentation regarding this problem?

Re: Anti-Exploit and Zero Phishing Licensing Problem in SBA

PhoneBoy — Sat, 22 Aug 2020 00:20:03 GMT

Threat Emulation/Extraction is not included with SBA Basic.
Here's what the Product Catalog says:

Re: Anti-Exploit and Zero Phishing Licensing Problem in SBA

MikeB — Sat, 22 Aug 2020 00:54:50 GMT

Hi PhoneBoy!

Yes, I know that we need SBA Advance for TE and TX, but what I really mean is that with SBA Basic we get Zero-Phishing / Anti-Exploit / Static File, features that you need to configure within TE and TX policy, so you need also to deploy this blade to the endpoint to make them work (Or Not?) and thats why you get the licensing alert event if you disable TE and TX inspections (see the "do not..." actions in the policy)

Re: Anti-Exploit and Zero Phishing Licensing Problem in SBA

PhoneBoy — Sat, 22 Aug 2020 01:32:05 GMT

From what I can tell from TAC cases, this is expected behavior.
Maybe @Lior_Arzi can confirm.

Re: Anti-Exploit and Zero Phishing Licensing Problem in SBA

Guy_Avnet — Mon, 24 Aug 2020 11:10:44 GMT

Hi,

TE blade includes several technologies besides TE & TEX, like – Static Analysis, File Reputation, AnTEX, and more.

The current installation flow is to choose TE even when not using TE/TEX for the rest of the functionalities.

Now, the license violation alert you are getting is wrong and I will make it fixed.

In addition to that, the entire installation flow will be re-evaluated, trying to make that scenario clearer.

Thanks for your feedback and feel free to contact me again for any additional comment.

Guy