Threat Extraction UserCheck and Autonomous Threat Prevention Policy

[Alex-]

An environment has been upgraded to R81.10 and the decision has been made to use Autonomous Policy for TP.

From that moment, the UserCheck page for Threat Extraction reverted to the default built-in one if the user wishes to download the original document.

I've checked the documentation and can't seem to find a reference on how to specify it. There are references to UC on TP Blades in "Manage & Settings" but it's only for Approved and Cancel.

The log entry makes reference to the "Perimeter (recommended)" profile but since it's a built-in item it's not modifiable and doesn't appear in the list of profiles.

If I switch back to custom TP, the correct UC page appears since I can specify it in the Threat Extraction tab.

So, I wonder if it's for now supported to modify the UC page for this blade when running Autonomous Policy.

[G_W_Albrecht]

I would suggest to ask CP TAC how that may work with Autonomous TP.

[Alex-]

Custom UC pages for TEX are a limitation with Autonomous Policy so I've switched back to custom TP profiles as it's required for branding and language requirements.

[Alex-]

 Limitations can be overcome. 🙂

TAC made an impressive follow-up to provide a CLI-based solution to use both Autonomous Policy and custom UC for TEX.

[DorianGrey]

Hi Alex,

Can you please advise the solution?

Thank you,

[Alex-]

Hi Dorian,

The solution has been documented in an sk.

sk178764: How to use a custom UserCheck object for Threat Extraction in the Autonomous Threat Preven...

Regards,
Alex

[Alex-]

Built-in support for this is now present as of R81.10 Take 82.

PRJ-38198, PRHF-22998

UserCheck

UPDATE: Added support for custom UserCheck objects for Threat Extraction. Previously it was not possible to configure them when using Autonomous Threat Prevention Policy. Refer to sk178764.