Sandstorm blocking downloads even though I don't have a license

Sandstorm is not blocking anything.

This report says that 10 files are suspicious and would have been analyzed by sandstorm.  And then it says 10 files were excluded from analysis by sandstorm due to policy.  In your case "due to policy" means "due to the fact you are not licensed".  All files that are "Excluded by policy" are not blocked and are downloaded normally.

This report is basically saying "If you purchased a sandstorm license, we would have analyzed 10 files for you."

How do we see what files were suspicious? I have not turned on my 30 day trial yet, and have 1 file that was listed as suspicious. I would like to know what it thought was potentially bad.

C68

Off the top of my head I don't know what reports on the UTM will show it.

However in general Sandstorm is activated for files that are executable and for documents with executable content.

It would be handy to know. I am going to guess that there is a report of what was sent, and the results. It would be good for this to be emailed to us. Palo does this...

Try this:

Logging and Reporting

View Log Files

Search Log Files

Web Filtering

Search term=   sandbox="1"

Try this:

Logging and Reporting

View Log Files

Search Log Files

Web Filtering

Search term=   sandbox="1"