Allow png, jpg.

[earomero]

Good morning from Argentina, I hope you are well.
In my governmental CNV organization, I cannot allow the download of .jpg and .png files.
I attach the error and the policies that I implemented to allow jpg and png.
I can download the office files.

Muchas gracias, saludos!

[the_rock]

Greetings from Canada! I have to say, Argentina is pretty cool country and in my opinion, BEST meat dishes in the world : - )

Anywho, I believe below is what you need, but will check with one of my colleagues.

Andy

 

[the_rock]

Saludos again! I think this must be it.

Andy

 

[earomero]

Hello, thank you very much for your reply. We do have some very tasty meats, thank you!

I have the .jpg and .png exclusions activated and I cannot download those types of files. Ideally, they should not be excluded, but rather sanitized and returned clean.
The current policy shown in the photo would not impact my organization. What can I do?

Saludos!

[the_rock]

That looks right to me. Sorry mate, Im not really endpoint furu, so would probably verify with TAC as well. lets see if anyone else may know.

Andy

[AdiGH]

Hey @earomero,
You will need to configure this here:

[the_rock]

Just checked client environment, dont see that option there...

Andy

[AdiGH]

Cloud or on-prem? if this is cloud, can you share a screenshot of the configuration available under 'download protection' in Advanced Settings?

[the_rock]

This is cloud.

See below, unless Im looking at the wrong setting?

Andy

 

[AdiGH]

You are in a different view, we usually call it 'split mode' which is mostly common to tenants migrating from on-prem. 

In any case, can you take a look under 'Threat Emulation' advanced settings? 

[the_rock]

Yup, see below. I see override action is available under threat emulation...I reckon that has to be it? 🙂

Andy

 

[AdiGH]

Yes 🙂

[the_rock]

Cool, thank you! Lets see if thats same setting @earomero needs.

I more asked, just being curious : - )

Andy

[earomero]

Hello, greetings from Argentina, thank you very much for answering.
Yes, it does indeed work! However, this configuration is a bypass to the checkpoint agent. There is a way for .jpg and .png files to go through the agent and be sanitized. The objective is not to bypass checkpoint but to use it as a means to secure the environment.
Thank you very much, greetings!

[the_rock]

Hey @earomero 

Lets wait for @AdiGH to confirm, as its weekend already in Israel, so she may not reply until Sunday.

Best,

Andy

[earomero]

Hi! Ok, I'm waiting for your reply.

Gracias!!

[the_rock]

Hey @earomero 

Were you able to figure this out?

Andy

[earomero]

Hi, the recommendation you gave me is very good, however it is to allow unsupported files, creating a bypass in the checkpoint agent.
The objective is to allow .jpg and have them analyzed and sanitized by the checkpoint agent. It is difficult hahaha but not impossible, there must be a way to achieve it.
Greetings from Argentina!

[the_rock]

Did you open TAC case yet?

Andy

[earomero]

What is a TAC case? How can I open it?

[the_rock]

https://help.checkpoint.com

You need to have user center account or if someone else in your company does, they can open it for you. However, if you are an end user and have CP reseller, you can certainly ask them to open a case on your behalf.

Andy

[AdiGH]

Please reach out via feedback button in the UI, and I'll explain what can be done.