Advanced threat protection (sandbox)
We analyze unknown files and attachments in an isolated environment before they reach the user.
Entry points
Where unknown files get in
A file can reach the user by several routes. We connect the sandbox to your existing security tools, and they pass anything they do not recognize to it for analysis.
Email attachments
Email security passes the attachment on for analysis before delivery. A typical example is a document infected with a macro or script, which we also covered in our article on phishing.
Downloads at the network perimeter
The firewall forwards unknown files downloaded from the web to the sandbox. With encrypted traffic, the firewall has to decrypt the TLS connection to do this; otherwise it cannot see the file.
Files on the endpoint
Files that reach the machine some other way, for example from a USB drive or through cloud storage sync, are sent for analysis by endpoint protection.
The analysis
What happens in the sandbox
Traditional antivirus looks for the signatures of known malware, so it does not recognize new or modified malware. The sandbox runs the file and judges it by how it behaves.
Isolated execution
The file is opened or launched on a separate virtual machine. From there it cannot reach the real network or user data.
Watching its behavior
The system records which processes the file starts, what it changes on disk and in the settings, and which external addresses it tries to connect to.
Verdict
Based on the observed behavior, the sandbox classifies the file as clean, suspicious, or malicious.
Handling by policy
Once there is a verdict, the handling policy decides what happens to the file, whether it is let through, quarantined, or blocked, and who needs to be notified.
Deliverables
What you get at the end
items handed over
- Deployed sandbox solution
- Integration with the firewall, email security, and endpoint protection
- Handling policies for suspicious files
- Handover documentation
Related services
The tools that send the files
The sandbox sees only what the connected tools pass to it. We also deploy these tools as separate services.
Firewall and VPN
Design, installation, and configuration of next-generation firewalls, together with VPN for site-to-site and remote access.
Email security
Protection against phishing, malicious attachments, and malicious links in email, fitted to your existing mail system.
Endpoint protection (EDR/XDR)
Behavior-based endpoint protection on workstations and servers.
Frequently asked questions
What people ask about the sandbox
Does the sandbox replace endpoint protection?
No. The sandbox can only examine files. Fileless attacks that work with built-in system tools are caught by the EDR running on the endpoint. The two complement each other.
Does the analysis delay email or downloads?
Running and observing a file takes time. In the handling policies, we define which files the system holds back until there is a verdict and which it lets through immediately and analyzes afterward.
Does the sandbox catch all malware?
No single layer of protection catches everything. Some malware detects that it is running on a virtual machine and behaves harmlessly there, and some only becomes active after a delay. That is why the sandbox is an additional layer of protection and does not replace your other tools.
Which files are worth analyzing in a sandbox?
Typically the ones that can run code: office documents, PDFs, scripts, executables, and compressed archives that contain any of these. The handling policies define the exact scope.
