Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Forsaken_61
Participant

Checkpoint Sandblast Threat Emulation - Threat Prevention API R82

Hello everyone,

I'm running a full scale Checkpoint Sandblast Threat Emulation environment, the environemnt Is running on-prem.
The environment bestands of,

2x Security Gateways, standard cluster functionality with Active/Passive.
Blades active --> Anti-Virus & Threat Emulation

2x Sandblast Threat Emulation Appliances (setup as Multi Private Cloud)
Blades active --> Threat Emulation

1x Management Server


The Security Gateways intercepts API traffic from internal applications, I'm using the Threat Prevention API to send in files for either Anti-Virus or Threat Emulation. Depends on the file size. 

The Security Gateways Is either analyzing files through "static analysis" or sends them for "remote" emulation against the Threat Emulation Appliances. This Is not configurable, ML involved here with the choice.

The environment runs,
R81.20
JFH Take 120

Now to my question. According to sk173494.
The Threat Emulation Appliances Is now R82 ready! 

Is there anyone else that sits on a similiar setup and have enrolled R82 in their environment?
Any news related to Threat Emulation or the Threat Prevention API?

Read some about the new ElasticXL functionality. Is that something that maybe I can benefit from? Since I now have Active/Passive. The neighbour usually blows "air". And the cache tables are not even synced inbetween the Security Gateways.

Thankful for answers.

Thanks!


0 Replies

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events