Kaspersky Sandbox detects and automatically blocks advanced threats on client devices (workstations, computers, servers, also referred to as "workstations").
If you have purchased Kaspersky Endpoint Security for Business and Kaspersky SandBox, you can connect your Artica Proxy in order to send downloaded files from Artica Proxy to SandBox analysis.
Starting Artica 4.30.000000 Service Pack 281, a new feature called SandBox connector allows you to send files to SandBox.
SandBox Connector is available for both Artica Corporate Edition and Community Edition
Currently, only Kaspersky Sandbox is supported.
We plan to provide Cuckoo Sandbox integration.
We intend to improve this section if Artica users are interested in this protection method.
Use the tracker site to express your opinion and features requests on this topic .
¶ Limitations:
¶ No real-time
The SandBox scan is expected to take several minutes, so the feature cannot block threats in real time.
When a user downloads a file, it is duplicated on the Artica box for SandBox scanning and waiting a maximum of 180 minutes (by default) for analysis.
If a threat is detected, a notification will be displayed on the Artica Web console or will be sent via Syslog/SIEM.
If the file is safe, it will be automatically removed from the Artica file system.
¶ HTTP vs HTTPS
In most cases, download transfers use SSL, if you have not enabled SSL decryption in Artica, only files downloaded via HTTP can be submitted to the SandBox.
¶ No more 60Mb
Files that exceed 60Mb (not compressed files) will be not submitted to the SandBox.
¶ Quick start
- You need Kaspersky SandBox installed on your network ( See the Video how to install Kaspersky SandBox )
- You need the ICAP HTTP service installed
¶ Install the SandBox connector
- On the left menu, choose “ICAP Service” / “Service Parameters”
- Click on the button “Connector [OFF]”
- You must see the “SandBox Connector” to green status and the button “SandBox [ON]"
¶ Set the Kaspersky SandBox address
- Click on “SandBox Connector" on the left menu.
- Under the “Kaspersky SandBox” section, turn on the “Enable the feature”
- Set your Kaspersky Server address
- You can set files to be submitted to the SandBox by selecting the Content-Type formats in the list of extensions.
- Click on Apply Button.
¶ Testing your SandBox by uploading a file
Do not try to test the eicar test file, it is a text format, the Sandbox is not designed to check text files.
- On the SandBox Connector section, click on the “Upload” button.
- A new page is displayed and click on the “Upload a file” to submit a file
- Results will be stored in the “results” tab.
You will see a table with all files submitted to the Sandbox and if the sumitted file is clean or not.
- To see your file processing, you can display events by using the “Logs Center” / “SandBox connector” Section
