topic Re: Whitelist Files in Threat Prevention in General Topics

Whitelist Files in Threat Prevention

Oliver_222 — Tue, 27 Jun 2023 09:10:45 GMT

Can you please tell me what the whitelist files in the Threat Prevention policies is for?

The firewall is blocking a zip file by antivirus blade.
We tried adding the MD5 hash of the file to the whitelist, but the blocking still happens.

I might be wrong somewhere. Can you tell me what might be the problem with this locking?

Re: Whitelist Files in Threat Prevention

PhoneBoy — Tue, 27 Jun 2023 20:44:00 GMT

Version/JHF?
What blades are active on the gateway?
Screenshots of all relevant logs (with sensitive details redacted)?

Re: Whitelist Files in Threat Prevention

Oliver_222 — Mon, 03 Jul 2023 14:55:08 GMT

R81.10 / Take 81

# enabled_blades
fw vpn cvpn urlf av appi ips identityServer SSL_INSPECT anti_bot ThreatEmulation content_awareness mon

Re: Whitelist Files in Threat Prevention

PhoneBoy — Mon, 03 Jul 2023 20:21:03 GMT

The file type is blocked per your log card, which means it doesn't matter what the MD5 is.
You will need to create an exception similar to: https://support.checkpoint.com/results/sk/sk137812

Re: Whitelist Files in Threat Prevention

Oliver_222 — Tue, 04 Jul 2023 12:18:04 GMT

I don't quite understand the phrase "it doesn't matter what the MD5 is". What is the reason for this behavior?
We are configured according to "Method B: Allow for only the specific files." sk137812