Threat Emulation - Advanced

What can I do here?

Use this window to configure these advanced Threat Emulation settings:

• Emulation Connection Handling Mode
• Engine Settings
• Logging

Handling Connections During Emulation

Emulation Connection Handling Mode lets you configure Threat Emulation to allow or block a connection while it finishes the analysis of a file. You can also specify a different mode for SMTP and HTTP services.

• Background - The connection is allowed and the file goes to the destination even if the emulation is not finished.
• Hold - A connection that must have emulation is blocked and Threat Emulation holds the file until the emulation is complete. This option can create a time-delay for users to receive emails and files.
• Custom - Lets you configure different modes for HTTP and SMTP. For example, you can set HTTP to Background and SMTP to Hold.

Best Practice - For configurations that use Hold mode for SMTP traffic, we recommend that you use an MTA deployment.

If you are using the Prevent action, a file that Threat Emulation already identified as malware is blocked. Users cannot get the file even in Background mode.

Static Analysis

Static Analysis optimizes file analysis by doing an initial analysis on files. If the analysis finds that the file is simple and cannot contain malicious code, the file is sent to the destination without additional emulation. Static analysis significantly reduces the number of files that are sent for emulation. If you disable it, you increase the percentage of files that are sent for full emulation. The Security Gateways do static analysis by default, and you have the option to disable it.

Logging

Lets you configure the system to generate logs for each file after emulation is complete.