Threat Prevention API on SandBlast Appliances

[Pedro_Madeira]

Hello,

I would appreciate if the community could comment or correct me in the following environment I'm about to set up.

I'm currently going through the instructions to set up a Threat Prevention API on SandBlast Appliances environment.

The environment will consist of:

1 API client (mail protection system acting as an MTA and API client)

1 Load Balancer

1 Security Management

2 x TE2000XN

I gathered all available information to me from Check Point's sources and this is my understanding how I should proceed with this setup:

1) Stage the TE2000XN appliances, patching, gaia configurations, etc

2) Add both TE 2000XN appliances to the security management

3)Enable Threat Emulation and Threat extraction blades

I don't really need the threat extraction blade but from what I've read, I think I need to enable this blade in order to activate the threat prevention api through smartconsole and generate an api key that will be located in /opt/CPUserCheckPortal/phpincs/conf/TPAPI.ini

Source: sk137032 and sk113599

4) Define a threat prevention policy to be installed in both TE appliances named Recommended_Profile

Source: sk113599

This profile should allow me to define which OS are used for emulation, file emulation limits and other settings.

5) Enable threat emulation api logs to smartlog with command:

[Expert@HostName:0]# tecli advanced remote emulator logs enable

Source: sk163998

Afterward the load balancers will make sure the api client sessions are distributed among the two TE appliances.

This is a summary of the steps I'm thinking on following and I would appreciate very much if I'm on the right track or if I'm misinterpreting some steps based on the sources I consulted.

Thank you for any tips and pointers in the right direction.

PM