[MUSIC] This module we will cover Threat Emulation, Check Point's sandboxing technology. With Threat Emulation, we will take files that are potentially might be compromised, send them to the ThreatCloud, have them emulated. And if there are threats get notified and block those connections. We can set the emulation connection handling mode for SMTP, IMAP, IMAPS and POP3. We also can change the location to remote emulation device instead of the default public ThreatCloud. The Threat Emulation Engine Settings, we can set the protection scope, to either all traffic, or just incoming traffic, from DMZ, or external. We can set the protocol to scan HTTP over any ports, SMTP, IMAP, IMAP secure, and POP3. We can configure which file types we want to scan. Another configuration is the emulation handling mode. Background, where connections are allowed until emulation is complete, or hold where connections are blocked until emulation is complete. Threat Emulation File Types. We can select the file types for Threat Emulation and we can choose if we want to inspect or bypass each type. We also have sandboxing reports. You can log into your user center account and you can click on the license for Threat Emulation and open up Threat Emulation reports. We can see the numbers here, how many were scanned, how many were emulated, and how many were malicious, what types they were and more. The private cloud with GAiA Embedded gateway supports a Private ThreatCloud. So essentially you can have an on premise SandBlast, threat-emulation threat-extraction appliance. The private threat-emulation appliance can be configured via the webUI. The default is going to be public cloud and you can see it can easily be changed. To set the threat emulation scopes you will need to go to threat prevention [MUSIC] Here we can see that all the blades are currently enabled and up to date. We will go to IPS protections. I can see all of the current protections, and here we have settings for IPS antivirus, anti-bots and threat emulation. So I can see the scope, the current scope is to scan incoming files from external and BMZ interfaces. I can click on that and customize the interfaces, or I can just scan both incoming and outward files, scan protocols, HTTP and mail protocols. The File Type policy, I can go ahead and configure specific file types and we have the handling mode that we've mentioned before. Background, where connections are allowed until emulation handling is complete. Or hold or connections are blocked until emulation handling is complete, which is more strict and the option for Detect Only mode. Don't forget if you're making any changes, hit Apply. That concludes the threat emulation module. [MUSIC]