We are working on a test phishing campaign to help educate our users on identifying bad emails.
Checkpoint is catching the bogus attachments and blocking the links in our test emails, which is both good and bad.
I've whitelisted the emails in the MTA, but I'm not sure if I'm able to somehow whitelist the external sender address or URLS on the other blades.
for example, on the AV Blade, dont prevent access to cnn.compromisedblog.com
or on the threat extraction/emulation, dont check or modify attachments from @gmailCompromised.com
