topic Re: Why is the Threat emluation engine update version different? in General Topics

Why is the Threat emluation engine update version different?

bund — Tue, 19 Sep 2023 08:49:57 GMT

Hello
I checked the log and found that the threat emulation release version and the actual updated version are different.

https://support.checkpoint.com/results/sk/sk95235

1. Why is it being updated to a version that doesn't appear in the sk document? What is this version?

(sk version 203->305 / actually version 278->305)

2. Also, according to the sk document, there was an engine update on August 28th, and the actual update date was August 25th.
Why does this happen?

Do you know anyone?

Thank you in advance.

Re: Why is the Threat emluation engine update version different?

G_W_Albrecht — Tue, 19 Sep 2023 09:01:21 GMT

ad 1. - I see 60.990000355 in your screenshot and in the SK :

Date	Release	Engine Version	What's New
28 Aug 2023	11.08	60.990000355	MemDive - a new approach to prevent encrypted payload hidden in memory enabled by default in TE ( Cloud mode only). Further info could be found in: sk181419 Improved DLL emulation mechanism triggers additional malicious behavioral

ad 2. - Usually, documentation is later than protection 😉 Why is that so important for you ?

I know at least someone...

Re: Why is the Threat emluation engine update version different?

bund — Wed, 20 Sep 2023 00:55:49 GMT

Thanks for your answer.

1. I understand that the sk document has version 60.990000355.
However, 60.990000278 is not in the sk document.
What version 60.990000278 is not in the release notes?
Will a new updated version be released even if it is not in the SK document?

2. That's not really important to me.

Based on client request, I needed a clear answer as to whether this was a normal update.

Re: Why is the Threat emluation engine update version different?

G_W_Albrecht — Wed, 20 Sep 2023 05:56:24 GMT

If you have a client request ask TAC in an informational SR# !