topic Re: Sandblast force quick update in General Topics

Sandblast force quick update

Dario1 — Thu, 16 Feb 2023 17:21:18 GMT

Afternoon gents, I have been playing with Threat Emulation (Sandblast) also looked at the R81 TP admin guide but probably not as much as I should have. At the moment Image update or the Detection Rules update isnt happening (see the pic attached) I had to play with the Internet access policy to make sure TP updates are allowed which they are now. The two curl commands below now return successful response.

"the two curl commands format not allowed in this post I had to remove it."

Is there any way of forcing the Image and the detection rules update rather then having to wait for the scheduled update to kick in tonight?

Is there a definitive list of Threat Emulation & Extraction FQDN's we need to allow out in order for TP to update with confidence.

thanks for your help again.

Re: Sandblast force quick update

PhoneBoy — Thu, 16 Feb 2023 18:18:21 GMT

Using the Check Point Services Dynamic Object is a surefire way to allow access to the relevant resources.
For a specific list related to Harmony Endpoint, see: https://support.checkpoint.com/results/sk/sk116590

Re: Sandblast force quick update

Chris_Atkinson — Thu, 16 Feb 2023 23:23:57 GMT

Option 1: CLI commands

Trigger:
tecli advanced downloads ... = downloads actions
tecli advanced downloads update ... = initiates Threat Emulation engine update
tecli advanced downloads update all = Threat Emulation engine update of all components
tecli advanced downloads update images = Threat Emulation update of images
tecli advanced downloads update rules = Threat Emulation engine update of malware detection and static analysis rules (sk117672)
tecli advanced downloads update file types map = mapping of file types to real extension used in Windows OS
tecli advanced downloads update raw = Threat Emulation engine update of raw files (engine binary updates)

Verify:
tecli advanced engine version = displays the engine version
tecli show downloads all = status of all downloads

Option 2: Offline Update

sk92509 - Offline updates for Threat Emulation images and engine

Re: Sandblast force quick update

Dario1 — Fri, 17 Feb 2023 09:44:05 GMT

PhoneBoy & Chris thank you boys really appreciate it, that answers both of my queries with flying colours. I now got the full list of update URL's as well as a list of commands to invoke TP updates. Many thanks.