- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Threat Emulation Quota Exceed
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Threat Emulation Quota Exceed
hi,
Checkpoint is showing that the quota has been exceeded at start up of the smartdashboard. What does that really mean? Does CP stop to emulated the file after it exceeded the file limit? CP has used the quota term in the documentation but not mention the exact quota we get with NGTX license. My concern is, what will CP do when the quota get exceeded ?
Regards,
Sagar Manandhar
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey,
As far as I know the emulation stops once you exceed the quota.
You can verify your quota ...
=> within the Threat Emulation tab of the gateway overview within SmartConsole
=> via the Threat Emulation command line (TECLI): "tecli show cloud quota"
=> within the Check Point UserCenter
The quota exists to save yourself and the Check Point Cloud, so that if you should be under attack, that you do not "waste" all of your emulations in a short time (which is unusual for normal use cases).
There is also the sizing tool available which lets you see how many emulations would be required for your environment.
More details regarding this can be picked up at SK93598.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Even though we get the message that the quota has been exceed we can see the log of file being emulated . Is this the normal behavior and the number of file also increase exceeding the quota (eg: 26000 out of 25000 has been emulated) when seen in smart view monitor.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Emulation always "stops" once we determine a file is malicious or not 😁
But I assume you mean if, for instance, we are unable to start emulation due to a system error or an invalid license. Then this setting applies.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe at a certain percentage above your licensed quota, it will stop emulating.
Offhand, I don't recall what the "hard" limit is.
If you see this error frequently, it may be time to have a chat with your local office, though.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Or carefully considere if everything you emulate now has to be emulated.
Having said that we still have a hard time getting the Windows Updates from being emulated.
