When a file arrives at the emulator its hash is compared with a list of hash in the emulator.
If it is a file that is not yet known its hash is stored to check it with the hashes of future files.
Is the file also stored to send a clean file to the client faster?
For how long time the file is stored on the emulator?
Hi. The file itself is not stored in the cache. Just the hash. And how long the hash is stored.... dunno. Believe you can modify the number of file hashes to save in local cache, if I don't remember wrong.
I'm looking this book: CP_R77_ThreatPrevention_AdminGuide.pdf.
This database helps to optimize emulation and give better network performance.
Please, I need to understand "optimize emulation and give better network performance".
When one file is extracted: I suppose that if one file was previously emulated and extracted is not necessary to emulate and extract this file again.
But if is not necessary emulate this file again, I suppose that the this file (after extraction) was store when it was emulated.
So, is ready to send to user when the Sandblast receive its hash again.
Is it correct or I lost something?
Or the "optimization" is valid only for the files that is not necessary to emulate again because are "clean" without extraction?
That means, if a file hash is already stored in the cache, when a file with the same hash arrives in an email attachment or to be downloaded from web, there is no need to send it to the te for full Emulation again.
This reduces network traffic to a local sandblast appliance or checkpoint cloud. And if it has not to be emulated again, emulation is optimized.
Not the file itself, just the file hash.
The gateway detects a file, calculates the hash and compares it with ist file hash cache. If it's a known hash, the file is passed or dropped according to the last scan/emulation result. The sandblast will not be involved again.
"Sandblast" may be located on the gateway itself (emulate locally), in the cloud or on a local, separate device.
Not just the clean ones. When a file "arrives" at the Gateways which has a hash which is stored in the cache and already being classified as malicious, it will be immediately be dropped, i assume.
I'm looking in the Threat Extraction configuration.
"Delete stored original files older than ..."
Which kind of file are considered in this option?
Suspicious / malicious files are stored in quarantine area on the sandblast appliance for further examination. For instance to check if there are false positives.
I suppose that the default time to live that files are stored in the cache is 7 days.
But in the previously image that I attached before I can see default value is 14 days.
--> "Delete stored original files older than ..."
Are these different kind of files?
Is there only one cache for all the VM images or one cache for all VM image?
And I assume there is one cache independent of VM.
There is a confusion between Threat Emulation and Threat Extraction here.
You can also manipulate the cache via some # tecli cache .... commands.
This cache is queried each time a new file arrives. If the SHA1 is found in the cache the related verdict and actions will be immediately taken without re-remulating the file (this improves performance and throughput). You can check the cache hit rate via # tecli show statistics.
Thanks for answer, now is clear!