bypassing Anti-Virus and threat emulation and extraction

[NorthernNetGuy]

We are working on a test phishing campaign to help educate our users on identifying bad emails.

Checkpoint is catching the bogus attachments and blocking the links in our test emails, which is both good and bad.

I've whitelisted the emails in the MTA, but I'm not sure if I'm able to somehow whitelist the external sender address or URLS on the other blades.

for example, on the AV Blade, dont prevent access to cnn.compromisedblog.com

or on the threat extraction/emulation, dont check or modify attachments from @gmailCompromised.com

[G_W_Albrecht]

That can be found in Threat Prevention R80.40 Administration Guide p.61ff: Shows how to create a system in which Threat Emulation allows the emails, but does not send them to the recipient right away. Instead, it puts them in a container where you can check them and then decide whether to block or allow them. Then you see how to exclude emails from Threat Emulation and Extraction. You also find AntiBot, IPS and AV information.