Exclude File from Web Downloads Protection

[Sitarz_T]

Hi, i have a question regarding the Sandblast web Download protection.

My Client tries to download some java applet file called "application.tmp"

The File is getting deleted because it "was found as malicious by checkpoint file reputation"

I already have whitelisted the Domain this file is coming from, but my client still cannot download it.
In the "Web Downloads Protection" Policy, there is an possibility to override the Action by file type, but since its not an "official" file type, there is no definition of .tmp files.

How can i whitelist this specific file download?

Thanks and Best Regards from Germany

[Gal_Carmeli]

Hi,

Can you please share how exactly did you exclude? (please mention the exact values you placed in the management, and the exact fields on the management UI that you changed)

Also - can you please share details about the file? (the download link would be helpful if you have it, or just attach the file to this post)

Thanks,
Gal.

[Sitarz_T]

After playing around and some clarification i got the use-case wrong.

My Client does the following:
They Download an .exe from one of our distributors (self signed application, im not allowed to share it)
The .exe , after execution by an admin-user, unpacks a few files. those unpacked files are getting blocked by the Sandblast File reputation. Afterwards the .exe file gets deleted, but the unpacked files not. Sorry for that, by the time i have written this post i only had a screenshot which blocked the said "application.tmp".

In order to allow this, i now need to get a test-client. Download and execute it by myself. And get the sha1 signatures of every file unpacked by the downloaded .exe.
Then i need to add those sha1 signatures as exceptions.

i simply was hoping for an more comfortable way, because it felt wrong doing it like this.
further, i also could whitelist certain folders but i dont like the approach of whitelisting local folders, since this enables users to override the security features by executing stuff from a dedicated directory.  Is there a third approach im missing?

[Gal_Carmeli]

Hi,

you can also exclude the entire folder if you know where the temporary files will be written to.

But - if the issue is a false-positive, I would very much like to handle it and analyze the reason for it. Will you be able to provide me with a link to download that application? If not, can you share it with me? Assuming its benign, I can make sure the false positive is fixed and then you will not need to exclude anything...

Thanks,
Gal.

[Sitarz_T]

Hi Gal, thanks for the Response.
i cannot provide a download link. But i can share the installation file with you.
can you provide something to upload it?

Thanks and BR

[Doron_Zuckerman]

Hi Sitarz_T,

Please upload the file here:

https://ftp.checkpoint.com/EFTClient/Account/Login.htm

user : SBAcustomer

pass : yqrfsE3x

Can you please ping me via email once you do (doronzu@checkpoint.com).

Thank you,

Doron.