Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
NorthernNetGuy
Advisor

bypassing Anti-Virus and threat emulation and extraction

We are working on a test phishing campaign to help educate our users on identifying bad emails.

 

Checkpoint is catching the bogus attachments and blocking the links in our test emails, which is both good and bad.

I've whitelisted the emails in the MTA, but I'm not sure if I'm able to somehow whitelist the external sender address or URLS on the other blades.

 

for example, on the AV Blade, dont prevent access to cnn.compromisedblog.com

or on the threat extraction/emulation, dont check or modify attachments from @gmailCompromised.com

 

0 Kudos
1 Reply
G_W_Albrecht
Legend
Legend

That can be found in Threat Prevention R80.40 Administration Guide p.61ff: Shows how to create a system in which Threat Emulation allows the emails, but does not send them to the recipient right away. Instead, it puts them in a container where you can check them and then decide whether to block or allow them. Then you see how to exclude emails from Threat Emulation and Extraction. You also find AntiBot, IPS and AV information.

CCSE CCTE CCSM SMB Specialist
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events