Advanced Threat Prevention Engine Settings
Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.25 Locally Managed Administration Guide | 200
Threat Emulation
To configure the Threat Emulation settings:
1.
Select one of the protected scope options:
n
Scan Incoming files from - Select one of these interfaces from which to scan incoming files:
l
External and DMZ
- Files that originate from external and the DMZ interfaces are
inspected.
Note
- DMZ is not supported in 1530 / 1550 appliances.
l
External
- Files that originate from external interfaces are inspected.
l
All
- Files transferred between all interfaces are inspected.
Note
- LAN to LAN scanning is not supported.
n
Scan both incoming and outgoing files
- Files that originate from outside the organization
and from within the organization to the Internet are inspected.
2.
Select the protocols to scan for the selected scope:
n
HTTP (on any port)
n
Mail (SMTP
,
POP3
and
IMAP
.
You must activate the
SSL traffic inspection
to scan HTTP and IMAP encrypted traffic. To
activate, click the link or go to
Access Policy
>
SSL Inspection Policy
.
3.
For file type policy:
n
Process specific file type families
- Click
Configure
for a list of file types and set prescribed
actions to take place when these files pass through the Threat Emulation engine.
To edit an action for a specified file type, right-click the row and click
Edit
. You can also click
the file type so it is selected and then Click
Edit
.
The available actions are:
l
Inspect
- The Threat Emulation engine inspects files of this type.
l
Bypass
- The Threat Emulation engine does not inspect files of this type and lets them
pass through.
You cannot delete system defined file types. System defined file types are recognized
by built-in signatures that cannot be edited.
4.
Select the HTTP connection emulation handling mode:
n
Background
- Connections are allowed until emulation is complete.
n
Hold
- Connections are blocked until emulation is complete.
In Threat Emulation, each file is run in the Check Point Public ThreatCloud to see if the file is malicious. The
verdict is returned to the gateway.
You can change the emulator location to a local private SandBlast appliance in the
Advanced Settings
page.
You must first enable the Threat Emulation blade and then configure it for remote emulation.
