- CheckMates
- :
- Products
- :
- Quantum
- :
- Threat Prevention
- :
- Anti-Virus not blocking malicious .zip, .doc files...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Anti-Virus not blocking malicious .zip, .doc files.
Observed in SmartEvent that the Anti-virus is not preventing the malicious files with extension .doc, .zip etc [with severity : critical and confidence : High ], instead it is just getting detected.
I would like to know whether this is a normal behavior in hashtag#checkpoint or did i have to make any changes in my anti-virus profile configured in threat prevention blade?
Note : Threat Emulation is not enabled in this environment.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A screenshot of the log (with sensitive data masked) might be helpful.
Also curious what setting you're using for Resource Classification as shown here:
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Dameon
Kindly find the relevant logs regarding the issue.
Log from SmartEvent :
Engine settings :
Anti-virus Profile :
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The first thing I would do is try setting the Resource Classification Mode to Hold instead of Background.
This will not allow the entire file to be sent to the endpoint until it is scanned.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Dameon
I got your point. At this point we cannot set the Resource classification to Hold, as there will be an impact on traffic as it holds the files till the scanning is completed .
But the thing is, i am I able to observe some of the events with Severity High and confidence level High is getting prevented by Antivirus inspection. but the same is not happening for Critical events. Any idea on this?
And it will be really helpful if you let me know what the "inspect" option under [Threat Prevention->Profile->(Profile name)->Anti-Virus settings->Process specific file types families ] do and what will be the outcome of it?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In some cases, the file can be blocked by URL or other characteristics without transferring the entire file.
This may be why you are seeing "prevent" in some cases and "inspect" in others.
It's likely a side effect of leaving Resource Classification in Background.
If you're concerned about end users being impacted by putting Resource Classification in Hold, create a separate Threat Prevention profile just for your mail server where it set to Hold.
Create a Threat Prevention rule that refers to your email server in the Protected Scope and apply your new profile.
Mail is pretty fault-tolerant and should not be negatively impacted by this.
In the Threat Prevention profile with regard to extensions
- Inspect means submit to ThreatCloud for analysis and allow only if deemed safe.
- Block means don't allow the attachment at all (irrespective of the file
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My smartdashboard only consist of 4 categories. Is there anything that I will have to change to make the other categories appear as well. I am currently using Checkpoint Network All In One Security.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A lot of the options from that area in previous (old) releases are now in the main SmartConsole.
The version mentioned in this thread being a no longer supported one in R77.30
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Background classification means the file passes and classification is done afterwards.
With hold it would wait for classification and the allow/block it based on verdict.
![](/skins/images/AB448BCC84439713A9D8F01A2EF46C82/responsive_peak/images/icon_anonymous_message.png)