Sandstorm testing

Michael Dunn: and you are telling us NOW? 1 week later after spending hours to try and test sandstorm? ...

What does it take for the AV engine to decide a file is a candidate for sandboxing? Personally I would hope that all EXE's downloaded from unrated sites would be submitted.....

With the current detection data, downloading an EXE from all but a few known, trusted providers will trigger the sandboxing process. Office documents and PDFs with active content such as macros or javascript will also.

The exact criteria will change as the threat landscape changes, which is why the detection is provided through the malware scanning engine and can be updated along with malware detection updates.

So, is it correct to say that sandboxing will not work for Web Filtering if AV Scanning is set to "Single" and "Avira" is selected as the 'Single scan engine' on the 'Scan Settings' tab?

Cheers - Bob

Then's there's an issue with this.... If you look at the Web log I pasted earlier, it was an EXE and from a "Uncatagorized" URL. For scanning, I am set to Single Engine: Sophos.......

That's correct, yes. The UI will provide warnings if you try to configure Sandstorm while AC Scanning is configured in that way.

EricShulze - the answer to this is either a.) you still do not have the right 'Sophos Identities' loaded to perform Sandboxing, these will be released very soon. or; b.) Sophos Engine did not determine anything suspicious of the file and decided to not send it to sandbox.

I think A is the more likely answer here based on comments from Rich.

So for clarity, I need to follow the directions to copy/install that file that is mentioned to be needed for MAIL to get sandstorm to work for WEB? If that is the case, you may want to update the pinned post.

No. The Sophos Identities to trigger Sandstorm scanning in WEB have YET to be released! This was mentioned up the thread. Michael Dunn mentioned this and if all goes well, these should be published within 24 hours...