cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Employee++
Employee++

Understanding Threat Emulation logs

In a TE log you can find additional important information how a file was processed:

In the example above "trusted source" means that this file was bypassed by the global whitelist hence it was not emulated.

Different values explained:

ValueComment
trusted sourcefile bypassed emulation due to Check Point maintained and automatically updated TE whitelist
emulatorfile was locally emulated on a SandBlast Appliance
cloud emulationfile was sent to cloud emulation
remote emulationfile was sent to a remote SandBlast Appliance for emulation (this log is usually issued by a gateway connected to a SandBlast appliance)
static analysisfile was pre-filtered by static analysis and was not emulated
local cachefile´s SHA1 was already found in cache (# tecli cache dump all) and was not emulated; action is based on the cached verdict
archivehandled file was an archive
loggerYou get "logger" for a "malicious" file as verdict decider when the file was not successfully emulated but other advisories already convitced the file as malicious
fileWhen trying to emulate the file the actual file size was 0

In depth info of e.g. static analyis, cache handling etc can be found in the amazing ATRG: Threat Emulation SK:

ATRG: Threat Emulation 

With this knowledge you can easily query all files that e.g. were really sent to cloud for emulation:

With SmartLogs Timeline results you can even quickly check how file amount was handled over a certain timeframe.

This is also helpful for investigating performance/throuput issues.

3 Replies
Olga_Kuts
Silver

Re: Understanding Threat Emulation logs

Thanks for explanation! But what does this output mean?

Win7,Office 2013,Adobe 11:logger

Employee++
Employee++

Re: Understanding Threat Emulation logs

Hi Olga,

good question 🙂

We run several so called "investigators" in TE. One of them is "logger" - it is responsible for creating a summarized report when the verdict is "malicious".

The logger is then sending the log to the Mgmt. When the verdict "decider" is "logger" it means that the file arrived at the logger investigator with no previous conviction by TE.

This can happen when emulation is not possible due to an error in the emulation process. So usually this results also in an emulation error but if other advisories (besides the sandbox emulation) already convicted the file as malicious the logger changes the "error" verdict to "malicious".

So as a summary:

You get "logger" for a "malicious" file as verdict decider when the file was not successfully emulated but other advisories already convicted the file as malicious.


Regards Thomas

Andre_K
Nickel

Re: Understanding Threat Emulation logs

Dear Thomas,

Regarding the value 'trusted source', is it possible to view the contents of the TE whitelist maintained by Check Point?

Best regards,

Andre