Haven't been able to get it trigger. Just had a system download 50 samples via Malshare over HTTP and not one got blocked by AV, or submitted to Sandstorm.... I just checked the the websites/sample downloads are all logged in the web access logs and logs looks like this sandbox="-"
Yeah but did those 'samples' from Malshare get picked up by the Anti Virus scan conducted by the proxy? And, what are the size of those samples? Do you have your Web Filter policies set to NOT SCAN files that are above a certain size? A full web filter log excerpt would be good.
AzRoN: files i tested from Malshare were less than 1 MB in size. 1 got detected by AV engine, Rest passed through. Virustotal says the file is infected, in my opinion sophos utm should at least make use of that sandbox scan in this case.
Hi Shai,
email sent. If you got anything i can test please let me know. This feature (if it works good) is interesting depending on how much you will charge for it.
