cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

Threat Emulation Quota Exceed

hi,

Checkpoint is showing that the quota has been exceeded at start up of the smartdashboard. What does that really mean? Does CP stop to emulated the file after it exceeded the file limit? CP has used the quota term in the documentation but not mention the exact quota we get with NGTX license. My concern is, what will CP do when the quota get exceeded ? 

Regards,

Sagar Manandhar

6 Replies
Maik
Silver

Re: Threat Emulation Quota Exceed

Hey,

As far as I know the emulation stops once you exceed the quota.

You can verify your quota ...

=> within the Threat Emulation tab of the gateway overview within SmartConsole

=> via the Threat Emulation command line (TECLI): "tecli show cloud quota"

=> within the Check Point UserCenter

The quota exists to save yourself and the Check Point Cloud, so that if you should be under attack, that you do not "waste" all of your emulations in a short time (which is unusual for normal use cases).

There is also the sizing tool available which lets you see how many emulations would be required for your environment.

More details regarding this can be picked up at SK93598.

Highlighted

Re: Threat Emulation Quota Exceed

Even though we get the message that the quota has been exceed we can see the log of file being emulated . Is this the normal behavior and the number of file also increase exceeding the quota (eg: 26000 out of 25000 has been emulated) when seen in smart view monitor.

0 Kudos

Re: Threat Emulation Quota Exceed

Hello, if the emulation stops. what happen with the mails: CP dropped it, CP allow it without inspection, CP enqueued it and then release?
0 Kudos
Admin
Admin

Re: Threat Emulation Quota Exceed

Emulation always "stops" once we determine a file is malicious or not 😁

But I assume you mean if, for instance, we are unable to start emulation due to a system error or an invalid license. Then this setting applies.

Screen Shot 2019-03-19 at 5.04.15 PM.png

0 Kudos
Admin
Admin

Re: Threat Emulation Quota Exceed

I believe at a certain percentage above your licensed quota, it will stop emulating.

Offhand, I don't recall what the "hard" limit is.

If you see this error frequently, it may be time to have a chat with your local office, though.

Re: Threat Emulation Quota Exceed

Or carefully considere if everything you emulate now has to be emulated.

Having said that we still have a hard time getting the Windows Updates from being emulated.