Which file types does Threat Emulation support? How can I make sure that I inspect them all?

[Tomer_Sole]

In R77 SmartDashboard there was a notification for "new file types supported" and a link to configure. What is the alternative to this in R80?

[Tomer_Sole · Accepted solution]

R80 does not notify on newly supported file types for the Threat Emulation engine. A best practice would be to check the list of supported file types following every update to the blade.

To view all supported file types, click on Manage & Settings --> Blades --> Threat Prevention. Then select the Threat Emulation page and click on "file types". Check the file types that you wish to inspect in all of your profiles by default.

The next step will be to check whether you would like your threat prevention profiles inspect all selected file types, or only a subset of them. By default they inspect all the selected file types from the previous step.

You can configure your threat prevention profile settings when navigating to Security Policies-->Threat Prevention-->Policy. Then the bottom part changes to "Threat Tools" with a link to the Profiles page.

    

The profile settings have a Threat Emulation page. In this page, you can choose whether to inspect all supported file types (from the blade settings page) or to bypass some of them. To bypass, change the file types configuration from "all" to "specific", and then inside the configuration page, right click specific file types and change their action from "Inspect" to "Bypass".