Thread Emulation - get prevented file from Threat Cloud?

[BB-MDK]

Hey guys,

is it possible to get a file from Check Point Threat Cloud which has been prevented by TE?

Maybe something similar to the CLI command "scrub send_orig_file"?

Or is it only possible to create an exception and let the file be sent again?

Thanks and Kind Regards

[PhoneBoy]

I believe scrub send_orig_file will still work even when emulation is done in the cloud as the file should be stored on the gateway that preventing it.

[BB-MDK]

Hi PhoneBoy,

thanks for your comment. I only have one log entry about the block event and it's the thread emulation blade. In the log I don't have a field with file-id...

[PhoneBoy]

Can you provide a log card?
Redact any sensitive details of course.

[BB-MDK]

Sure - there you go

[PhoneBoy]

I wonder if you can see the fileid in /var/log/maillog