E2 Sophos Ai/ML

[secronis]

Did CP integrate the full Sophos SDK? Is their ML engine included as like Kaspersky is?

[PhoneBoy]

I believe the only thing a third party engine is used for is static file analysis.

[secronis]

The included Kaspersky SDK has runtime ML enabled thru it's PDM named detections. Those are static and dynamic models. 

In the case of Sophos... ML-PE & ML-PUA is their local deep learning static model. 

Back to the question. Is the full Sophos SDK integrated into CP? Thanks. We are well aware of all the engines on the market.

[PhoneBoy]

It may be/have been integrated, but support for it is a separate question.
I recommend reaching out to your local Check Point office to discuss your precise requirements.

[G_W_Albrecht]

According to my in-depth CP TP trainings, only a hash is sent by AV to compare with the Kaspersky AV database as a first TP step. Afaik ABOT, URLF and APCL use no Kaspersky engines - surely IPS, TE and TX do not.

[Trident]

It would make sense for a hash to be sent as a first step. The cloud will always have the most up-to-date information on objects which can be classified as:

Known safe: leave the object or scan once and leave (varies from vendor to vendor).

Known malicious: destroy the object, inform EFR which will take the object timestamp, check for additional objects created around this time (+- some offset of 20-30 seconds), and destroy all related objects. These additional objects can (and most likely will) include browser caches. Provided object was not executed, that will be all.

Unknown: object will be scanned using the full set of Kaspersky capabilities, including static analysis, dynamic analysis and definitions. The object will then be classified as "safe" or "malicious". If malicious, EFR will be informed.

[Trident]

The answer is no. The ML-PE detections in Sophos are not produced by the antivirus engine (Sophos SAVI), it is another engine in Sophos that’s doing the pre-execution machine learning. It is called InterceptX and I don’t see it offered on the Sophos OEM website.

The Sophos SAVI is known for its behavioural genotype detections and as of 87.30 if I am not mistaken, Sophos Live Protection (cloud lookups) are enabled too.

Pre-execution machine learning (Static Analysis) in Harmony is performed by a proprietary engine that covers executables, office files and DLLs.

[the_rock]

Personally, I would always open TAC case for these things, just to get an official answer.

Andy