SandBlast Agent for Browsers can be configured on the extension's options page. To open it, click on the Check Point icon in the browsers and press the options icon at the top right corner.

Here is an overview on the options page:

1. Enable/Disable SandBlast Protection for Web Downloads.
   
   
2. Configure policy for each collection of file types:
   
   There are three collections:
   
   
   • Supported files (TE + TEX) - both Threat Emulation and Threat Extraction are supported.
     
     
   • Partially Supported Files (TE Only) - only Threat Emulation is supported
     
     
   • Unsupported Files - files can be either allowed or blocked.

   Configuration options:

   • Extraction Settings - there are 3 ways to set this option:
     
     
     1. Use admin defied profile - The extraction settings are according to server's Threat Extraction profile.
        Note: Threat Extraction must be enabled in the Threat Prevention profile and in the Threat Prevention policy. Only "Extraction method" and "File types" settings are taken from admin profile.
        
        
     2. Extract potentially malicious elements - In this option the file will keep its type, and potentially malicious elements will be removed.
        
        
     3. Convert to PDF - File will be converted to PDF.
     
     
     
   • Emulation Setting - there are 2 ways to set this option:
     
     
     1. In the background - The file will be download to the user and emulated in the background.
        
        
     2. Hold until scan completes - The file will not be downloaded until it is emulated.
        
        
   • General Settings - there are 2 ways to set this option:
     
     
     1. Allow the files of the collection.
        
        
     2. Block the files of the collection.
     
     
     
   • Use the Advanced settings in order to configure 
     • Policy for specific file types 
     • Control the extracted elements when using "Extract potentially malicious elements".
     • More advance settings
   
   
   
3. Enable/Disable Zero Phishing Protection.
   Use the Advanced settings in order to configure Phishing Prevention settings and Password Reuse settings.
   • Phishing Prevention
     
     • Phishing Protection defines the action taken upon phishing detection.
     • Send log on each scanned site - The extension will send log for each scanned sites (Benign + Malicious)
     • Allow user to dismiss the phishing alert and continue to access the site - The user will be able to bypass the phishing warning and continue to fill the site's form.
     • Allow user to abort phishing scans - User will be able to stop the ongoing site scan
   • Password Reuse
     • Password Reuse Protection defines the action taken upon phishing detection.
     • Protected domains - Passwords used in these domains will be learned, and will be compared to passwords entered outside of the "protected domains"
4. Connected server describes the server that preforms Threat Emulation and Threat Extraction, there are 3 options:
   1. Gateway or SandBlast Appliance. 
      • Mandatory instructions are described at sk113599.
   2. Cloud Only. 
      • Note that cloud API key is mandatory
   3. Gateway with fallback to the Cloud
      • SandBlast Agent for Browsers will try to connect to the specified gateway, if there is no connectivity to the gateway it'll try to connect Threat Cloud.
5. Excluded Domains - Downloads/Phishing scans from these domains will be excluded from SandBlast policy.
   
   
6. You can use Export Configuration in order to export the saved options.

When working with SBA, Chrome extension is enabled by default, while IE can be controlled through GuiDBedit Tool as follows:
until version 80.70 (including), the IE is disabled b default, and can be enabled by the following procedure:

1. Close all SmartConsole windows and open the GuiDBedit Tool.
   
   
2. Go to ep_orgp_te_policy_tbl
   
   
3. In each line with the class name ep_orgp_te_web_downloads_protection_action, find the field browser_extensions_additional_data and add the value: ie_extension_disabled=false
   
   
4. Save the changes: go to 'File' menu - click on 'Save All'.
   
   
5. Open SmartEndpoint Console.
   
   
6. Make a small change in a SandBlast Agent Threat Emulation rule, which will cause it to change policy version number and load changes from GuiDBedit Tool.
   
   
7. Install policy in SmartEndpoint.
   
   
8. Update policy on Endpoint
   
   

From version 80.71, the IE extension is enabled by default, and can be disabled by following the below procedure:

1. Close all SmartConsole windows and open the GuiDBedit Tool.
   
   
2. Go to ep_orgp_te_policy_tbl
   
   
3. In each line with the class name ep_orgp_te_web_downloads_protection_action, find the field browser_extensions_additional_data and add the value: ie_extension_disabled=true
   
   
4. Continue with the steps 4 - 8 from the above instructions.

1. Close all SmartConsole windows and open GuiDBedit Tool.
   
   
2. Go to ep_orgp_te_policy_tbl
   
   
3. In each line with the class name ep_orgp_te_web_downloads_protection_action, find the field browser_extensions_additional_data and add the value:
   firefox_extension_disabled=false
   
   
4. Continue with the steps 4 - 8 from the above instructions. 
   
   

When working with Firefox browser, export the policy as .json file (not .reg file), save it with name "manifest.json" and place it using GPO in the C:\Program Files (x86)\CheckPoint\SandBlast\. folder.

The changes will take effect after you restarting the Firefox.

It's recommended to use the SandBlast Agent for Browsers options to set the policy, and export the configuration into registry file in order to deploy it in the organization.

To configure the SandBlast Agent for Browsers using GPO, add the following registry path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\bnbpncoilnpdbcbfcegbjocobjppndlh\policy

Notes:

• The registry values control the SandBlast Agent for Browsers options. You can choose not to configure the SandBlast Agent for Browsers, in which case it will use the default values
• Controlling the SandBlast Agent for Chrome using GPO is possible only if the machine is member of AD domain.
• Policy changes in registry will apply within 10 minutes.

Below you can see the different configuration options and their values

General Settings:

SandBlast Protection for Web Downloads settings:

Zero Phishing Protection settings:

Example of a *.reg script: (Threat Emulation and Threat Extraction)

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\bnbpncoilnpdbcbfcegbjocobjppndlh\policy]
"excluded_domains"="[ \"onesite.com\", \"secondsite.org\" ]"
"pdf"=dword:2c
"fdf"=dword:22c
"7z"=dword:28
"allowed_file_types"="[ \"txt\", \"log\" ]"
"blocked_file_types"="[ \"bat\", \"reg\" ]"
"fail_close"=dword:00000001
"server"="security.gateway.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist]
"1"="bnbpncoilnpdbcbfcegbjocobjppndlh;https://clients2.google.com/service/update2/crx"

In this example Chrome is forced to install the SandBlast Agent for Browers with the following options:

• No action will be taken for files downloaded from onesite.com or secondsite.org (excluded_domains=...)
• "Emulate and Extract" action and "convert to PDF" for FDF files (fdf=22c).
• "Emulate and Extract" action "according to global profile" for PDF files (pdf=2c).
• "Emulate" action and "Hold till scan completes" for 7z files (7z=28).
• Emulate and Extract action for all other files according to the default settings.
• txt and log files are allowed
• bat and reg files are blocked
• Download is blocked in case of failure (fail_close=1).
• SandBlast inspection is performed by security.gateway.com (server=security.gateway.com).

Example of a *.reg script: (Zero Phishing)

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\bnbpncoilnpdbcbfcegbjocobjppndlh\policy]
"protected_domains"="[ \"onesite.com\", \"secondsite.org\"]"
"identity_protection_enabled"=dword:1
"phishing_detection_mode"=dword:2
"password_reuse_mode"=dword:2
"permit_continue_anyway"=dword:1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist]
"1"="bnbpncoilnpdbcbfcegbjocobjppndlh;https://clients2.google.com/service/update2/crx"

In this example Chrome is forced to install the SandBlast Agent for Browers with the following options: