Use Sandblast API on Security Gateway

[Jan_Kleinhans]

Hello,

we would like to create a webpage to let internal administrators test files against the Checkpoint Thread Emulation API.

We have NGTX License for our Gateway so I think it should be possible. We want to use the ThreadCloud. This is already working on the gateway (80.20).

I followed the guide to enable the API (sk113599) but I have no optin in SmartDashboard to Enable the API and if we open https://<IP_Address_of_Security_Gateway>/UserCheck/TPAPI

it says 

Not Found

The requested URL /TPAPI was not found on this server.

Can the API not be used with Threadcloud from a NGTX Gateway? 

Best Regards,

Jan

[PhoneBoy]

You can only enable the API on a Threat Emulation appliance.

Otherwise, you can make API calls against the ThreatCloud, which you have access to as a result of having an NGTX Subscription.

[Jan_Kleinhans]

Hello,

thank you for the quick answer. How can I use the Threadcloud API. Is there any SK or Howto ?

Thanks,

Jan

[PhoneBoy]

It's described in the Threat Prevention API 1.0 Reference Guide 

The only real difference is:

• The endpoint used
• You need to include an API key in the request (not required for a local appliance)

[Jan_Kleinhans]

Do I have to open a case to get the API Key or how to get it?

[PhoneBoy]

As I'm looking into this, it appears you may need a specific license to call the Cloud API directly.

You can generate an evaluation license for it under Product Evaluation > Other Evaluation Option > Threat Emulation > Threat Emulation Cloud API (CPCS-TE-API-A-EVAL-SOC).

Inside the Eval License, you then have the option to generate one or several API Authorization keys.

To acquire said license on a permanent basis, consult your local office.