Not all images for emulation on SandBlast TE1000X

[Olga_Kuts]

Hello all!

We have SandBlast appliance TE1000X (take 292, Threat Emulation engine version 55.990001820). We see only 2 images for emulation in general properties: Windows 7 unpatched and Win XP. SandBlast appliance has Internet access. 

Why do we see only 2 images, and how to automatically download other possible images?

[AlekseiShelepov]

I believe that you have only two images because it is the recommended OS image package. There is also a 7 OS images package (more info here: Offline updates for Threat Emulation images and engine) which is ~47 GB in size.

I cannot say how to download them without additional manual actions, as I didn't work with TE much. I think it is possible to manually download additional images, enable required ones, and then get automatic updates from Check Point cloud. But let's wait till somebody can confirm this.

This SK could be helpful - ATRG: Threat Emulation. I would recommend to check section (24) Troubleshooting - When emulating files on the Local Threat Emulation Private Cloud Appliance installed on your network.

# tecli show downloads all

# tecli advanced engine version

And remember, more images you use - more hardware resources are needed. 

[Olga_Kuts]

Everything was much easier))

To make the images for emulation available for selection in the SmartDashboard, it is necessary that the management server must has access to the te.checkpoint.com, not only gateways. In my case, the proxy needed to be configured not only in the General Properties of the CheckPoint objects, but also in the Global Properties.