Sandboxing tab (Breach Fighter)

Sandboxing

Status This column displays the status (Enabled/Disabled) of sandboxing for the corresponding file type. Double-click on it to change its status.
File types The sandboxing option allows different types of files to be scanned:
  • Archive: these include the main types of archives (.zip, .tar, .rar, .gz, gzip,. bz2,. 7z,. etc).
  • HTML file
  • Office document (Office software): all types of documents that can be opened with the MS Office suite.
  • Executable: files that can be run in Windows (.exe, .bat, .cmd , .scr, etc).
  • PDF: files in Portable Document Format (Adobe)
  • Java (compiled Java files, e.g., files with a “.jar” extension).
  • Scripts: PowerShell, Javascript, VBScript, Batch, Python.
  • E-mail with attachment.
  • Image.
  • Others.
Max. size of sandboxed e-mails (KB) This field defines the maximum size of e-mails that need to be sandboxed. By default, this value is equal to the one in the Maximum size for antivirus and sandboxing scan (KB) field in the File analysis tab. This value cannot be exceeded.

Limits

  • Maximum size of the file to be analyzed: 10 MB.

  • Maximum number of files in the same e-mail or same archive: 10.

  • Maximum number of nesting levels in the same archive: 10.

Actions on files

When known malware has been identified This field contains two options.
  • By selecting Block, the analyzed file will not be sent.
  • By selecting Pass, the file will be sent in its original form.
When sandboxing fails This option defines the behavior of the sandboxing option if the file scan fails:
  • If Block is specified, the file being scanned will not be sent.
  • If Pass without analyzing is specified, the file being scanned will be sent.