TA SandBlast MTA Blade - False Positive!?

[ld3d]

Hello CheckMates,

Is there a way to somehow check the xml file that TA SandBlast MTA Blade has already blocked and removed to see if it is a false positive?

Following scenario:

An external user sends an email addressed to a user in our organization.
The email contains an xml attachment (which was recognized as malicious by the SandBlast MTA), and thus has already been removed.
Now, colleagues from security want to examine that file - hence the question, is it possible to look at that file somehow?

Thanks in advance!

[Swordfish]

You can view the log from TE/TX in SmartConsole and from there open the forensic report e.g. Vulnerable Operating Systems > Summary. 

In the html report is on the top an Actions menu, where you can download the original file as an .tar.gz.

[Chris_Atkinson]

Per sk114806

Malicious files are stored in a repository on the Threat Emulation Appliance in the /var/log/mal_files/ directory (applies to all emulation deployments).

Malicious files are stored in a repository on the Security Gateway in /var/log/mal_files/ directory.

Suggest contacting TAC if further assistance is needed.