Sandstorm testing

AzRoN over 8 years ago

How can we test Sandstorm? Will there be a link on Sophostest.com to an innocuous file that will trigger a scan?

Parents

0 EricShulze over 8 years ago

Haven't been able to get it trigger. Just had a system download 50 samples via Malshare over HTTP and not one got blocked by AV, or submitted to Sandstorm.... I just checked the the websites/sample downloads are all logged in the web access logs and logs looks like this sandbox="-"
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 AzRoN over 8 years ago in reply to EricShulze

Yeah but did those 'samples' from Malshare get picked up by the Anti Virus scan conducted by the proxy? And, what are the size of those samples? Do you have your Web Filter policies set to NOT SCAN files that are above a certain size? A full web filter log excerpt would be good.

==

When in doubt, Script it out.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 AzRoN over 8 years ago in reply to EricShulze

You got me! This is where sgelbaum could comment best, we'd most likely require a sample of the file. I suspect due to the fact the AV scan yielded no local suspicious elements, and was clean then was not referred to SandStorm... but I'm not 100% sure this is the the workflow.

==

When in doubt, Script it out.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Michael Dunn over 8 years ago in reply to EricShulze

There are several steps to sandboxing:
Step 1: Sophos Anti-Virus says the file is a candidate for sandboxing
Step 2: Licensing and configuration are checked to see if sandboxing is enabled
Step 3: The file is checked against the cloud server to find out if it is a known file
Step 4: Unknown files are sent for sandboxing

If you are getting sandbox=- that means the files were not identified as candidates for sandboxing (failed step 1)
If you are getting sandbox=1 that means they are sandboxable but sandboxing is not configured (failed step 2)
Any other number means they got to Step 3 or 4.

Assuming for a moment that you are getting sandbox=- please make sure
1) The file is actually being virus scanned by the Sophos AV Scanner
2) The Sophos AV Scanner is up to date including all virus definitions
3) The file is under 10MB, is not also detected as a virus...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Michael Dunn over 8 years ago in reply to Michael Dunn

I believe that the u2d channels do not currently have the web definitions for sandboxing.
I believe that this should be resolved in next 24 hours.

Some people are finding that Sandstorm in web is working. It may be that those people have manually installed the definitions for Mail (see pinned thread). YMMV.

So the functionality is there - it is just that the scheduling of the the required data update did not match the beta start.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Ben over 8 years ago in reply to Michael Dunn

Michael Dunn: and you are telling us NOW? 1 week later after spending hours to try and test sandstorm? ...

---

Sophos UTM 9.3 Certified Engineer
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 EricShulze over 8 years ago in reply to Michael Dunn

What does it take for the AV engine to decide a file is a candidate for sandboxing? Personally I would hope that all EXE's downloaded from unrated sites would be submitted.....
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RichBaldry over 8 years ago in reply to EricShulze

With the current detection data, downloading an EXE from all but a few known, trusted providers will trigger the sandboxing process. Office documents and PDFs with active content such as macros or javascript will also.

The exact criteria will change as the threat landscape changes, which is why the detection is provided through the malware scanning engine and can be updated along with malware detection updates.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 BAlfson over 8 years ago in reply to Michael Dunn

So, is it correct to say that sandboxing will not work for Web Filtering if AV Scanning is set to "Single" and "Avira" is selected as the 'Single scan engine' on the 'Scan Settings' tab?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 EricShulze over 8 years ago in reply to RichBaldry

Then's there's an issue with this.... If you look at the Web log I pasted earlier, it was an EXE and from a "Uncatagorized" URL. For scanning, I am set to Single Engine: Sophos.......
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RichBaldry over 8 years ago in reply to BAlfson

That's correct, yes. The UI will provide warnings if you try to configure Sandstorm while AC Scanning is configured in that way.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 AzRoN over 8 years ago in reply to EricShulze

EricShulze - the answer to this is either a.) you still do not have the right 'Sophos Identities' loaded to perform Sandboxing, these will be released very soon. or; b.) Sophos Engine did not determine anything suspicious of the file and decided to not send it to sandbox.

I think A is the more likely answer here based on comments from Rich.

==

When in doubt, Script it out.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 AzRoN over 8 years ago in reply to EricShulze

EricShulze - the answer to this is either a.) you still do not have the right 'Sophos Identities' loaded to perform Sandboxing, these will be released very soon. or; b.) Sophos Engine did not determine anything suspicious of the file and decided to not send it to sandbox.

I think A is the more likely answer here based on comments from Rich.

==

When in doubt, Script it out.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 EricShulze over 8 years ago in reply to AzRoN

So for clarity, I need to follow the directions to copy/install that file that is mentioned to be needed for MAIL to get sandstorm to work for WEB? If that is the case, you may want to update the pinned post.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 AzRoN over 8 years ago in reply to EricShulze

No. The Sophos Identities to trigger Sandstorm scanning in WEB have YET to be released! This was mentioned up the thread. Michael Dunn mentioned this and if all goes well, these should be published within 24 hours...

==

When in doubt, Script it out.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel