Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
bunleang1
Participant

Sandblast Emulation/Extraction work?

Scenarios:

Gateway Enable threat emulation/extraction

Threat extraction: I knew that threat extraction proactive removed malicious content on file and ensure file delivery to user safe content 

Threat Emulation: when gateway received unknown file send to the cloud to run on virtual sandboxing cloud

My question

1) During the step gateway send the unknown file to the cloud does the gateway keep the unknown file on its own firewall? if it keeps the unknown file on its own firewall where is the location store the unknown file in?

2) Can we monitor the progress of the file during gateway send to the cloud? 

 

0 Kudos
1 Reply
PhoneBoy
Admin
Admin

You should be able to retrieve the original file by fileid (found in the log card) using the command scrub send_orig_file.

Actually, what's happening in many cases is the URL where the file is coming from is sent to the cloud and the cloud retrieves the file directly. 
In other cases (e.g MTA) the file is being uploaded from the gateway.
Believe you can monitor with tecli on the gateway.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

0 Kudos