topic Re: Block .lzn file extension in MTA Blade in General Topics

Block .lzn file extension in MTA Blade

SubZer0 — Mon, 15 Dec 2025 13:51:56 GMT

I would like to block the .lzh file extension in MTA Blade. When I go to the settings, this extension is not listed, even though SK106123 https://support.checkpoint.com/results/sk/sk106123 states that Check Point supports it.

Does this extension need to be added manually or configured additionally in the firewall?

Re: Block .lzn file extension in MTA Blade

Vincent_Bacher — Mon, 15 Dec 2025 19:03:50 GMT

You are talking about te blade, right?

Which release are you using?

Re: Block .lzn file extension in MTA Blade

the_rock — Mon, 15 Dec 2025 19:26:15 GMT

Im fairly sure I know setting you are referring to, but screenshot would help confirm.

Re: Block .lzn file extension in MTA Blade

SubZer0 — Mon, 15 Dec 2025 19:39:25 GMT

I am using MTA blade: 81.20.991002020 https://support.checkpoint.com/results/sk/sk123174

Re: Block .lzn file extension in MTA Blade

SubZer0 — Mon, 15 Dec 2025 19:44:59 GMT

Re: Block .lzn file extension in MTA Blade

the_rock — Mon, 15 Dec 2025 19:46:11 GMT

Let me check it in the lab, but yea, thats it.

Re: Block .lzn file extension in MTA Blade

the_rock — Mon, 15 Dec 2025 19:55:31 GMT

Just verified, tested R82 lab as well. file not listed. Wish those files extensions can be sorted alphabetically, but either way, its not present.

Re: Block .lzn file extension in MTA Blade

SubZer0 — Mon, 15 Dec 2025 20:00:18 GMT

Is it possible to add manually?

Re: Block .lzn file extension in MTA Blade

the_rock — Mon, 15 Dec 2025 20:03:50 GMT

Does not appear to be the case, cant find that option anywhere.

Re: Block .lzn file extension in MTA Blade

Chris_Atkinson — Mon, 15 Dec 2025 21:01:44 GMT

Note that you are looking at AV protections here and not TE.

The extension not being there doesn't imply that TE will take no action on malicious files.

Start here: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ThreatPrevention_AdminGuide/Topics-TPG/Threat-Prevention-Engine-Settings.htm?tocpath=Configuring%20Advanced%20Threat%20Prevention%20Settings%7CThreat%20Prevention%20Engine%20Settings%7C_____5#Selecting_Emulation_File_Types

Re: Block .lzn file extension in MTA Blade

the_rock — Mon, 15 Dec 2025 20:56:30 GMT

Just checked Chris, still not even there.

Re: Block .lzn file extension in MTA Blade

Chris_Atkinson — Mon, 15 Dec 2025 22:42:24 GMT

Are you sure?

Re: Block .lzn file extension in MTA Blade

the_rock — Mon, 15 Dec 2025 22:44:35 GMT

Yea, I know its there, I was referring to TP profile settings, its definitely not there.

Re: Block .lzn file extension in MTA Blade

the_rock — Mon, 15 Dec 2025 23:47:14 GMT

Apologies Chris, I see it worked now in the lab. I made sure lzh extension was enabled in blade settings, pushed policy and then it came up in the profile.

Re: Block .lzn file extension in MTA Blade

Vincent_Bacher — Tue, 16 Dec 2025 07:12:00 GMT

I don't mean to be pedantic, but MTA is a feature, not a blade.

The question was relevant since you linked to a Threat Emulation SK.

Re: Block .lzn file extension in MTA Blade

Vincent_Bacher — Tue, 16 Dec 2025 07:27:48 GMT

When I was still working intensively with it, I always had to be careful not to constantly confuse TE and TX, so I just remembered that there was an SK for TX where you could enable new file extensions via scrub configuration and add new extensions, while you had to submit a request for new file types for TE.

Re: Block .lzn file extension in MTA Blade

the_rock — Tue, 16 Dec 2025 11:45:11 GMT

Good point Vince.

Re: Block .lzn file extension in MTA Blade

SubZer0 — Tue, 16 Dec 2025 14:46:54 GMT

Thank you all for your cooperation. However, I still have an open question.

Is it possible to block attachments with the .lzh file extension on the MTA?

Under Threat Prevention → Threat Emulation, I have the .lzh extension enabled.

However, when I go to Threat Prevention → Threat Extraction → Configure File Type Support, the .lzh extension is not listed.

The same extension is also not available under Profiles → Anti-Virus, where it would otherwise be possible to block the file type.

Re: Block .lzn file extension in MTA Blade

the_rock — Tue, 16 Dec 2025 15:10:38 GMT

Keep in mind, those are 2 separate blades.

Re: Block .lzn file extension in MTA Blade

SubZer0 — Tue, 16 Dec 2025 15:59:47 GMT

I understand that Threat Emulation has this capability and Threat Extraction does not.
However, is it possible to add this functionality to Threat Extraction?