Capture Advanced Threat Protection Service for NSA 3650 (1 Year)

To effectively protect against sophisticated threats, organizations require advanced solutions that incorporate robust malware analysis technologies capable of detecting evasive and emerging threats. SonicWall’s Capture Advanced Threat Protection ™ (ATP) was the industry’s first multi-engine sandbox to offer block-until-verdict capabilities. This innovative technology rapidly delivers accurate verdicts on suspicious files and seamlessly integrates across the entire SonicWall product ecosystem for comprehensive protection both in the cloud and on premises.

Benefits 

• Advanced Threat Protection: Detects unknown malware before it enters the network
• Real-Time Deep Memory Inspection (RTDMI™): Identifies hidden or dormant malware with memory-based analysis 
• Multi-Engine Sandboxing: Detects evasive threats with multiple analysis engines • Broad File Type Coverage: Inspects various file types 
• Automated Threat Blocking: Blocks files at the gateway until verdict based on your policies
• Seamless Integration: Integrates with SonicWall solutions across your security architecture

Features

Multi-Engine Advanced Threat Analysis
Capture ATP Service inspects traffic, and it detects and blocks intrusions and known malware. Suspicious files are sent to the SonicWall Capture ATP Cloud for analysis. The multi-engine sandbox platform, which includes RTDMI and full system emulation technology, executes suspicious code and analyzes behavior, and provides comprehensive visibility to malicious activity while resisting evasion tactics and maximizing zero-day threat detection.

Real-Time Deep Memory Inspection (RTDMI)
The RTDMI engine enhances Capture ATP through proactively detecting and blocking mass market, zero-day threats and unknown malware by inspecting directly in memory. Because of the real-time architecture, SonicWall RTDMI technology is precise, minimizes false positives, and identifies and mitigates sophisticated attacks.

Broad File Type Analysis
Capture ATP analyzes a wide range of file types and sizes, including executables (PE), DLLs, PDFs, MS Office documents, archives, JARs, and APKs, across Windows and Android platforms. Administrators can customize protection by specifying which files to analyze based on file type, size, sender, recipient, or protocol. They can also manually submit files for analysis. Malicious files are retained in the database for one month, while benign files are automatically deleted within 24 hours.

Blocks Until Verdict
To prevent potentially malicious files from entering the network, files sent to the cloud for analysis can be held at the gateway until a verdict is determined.

Rapid Deployment of Remediation Signatures
When a file is identified as malicious, a signature is immediately generated for SonicWall Capture ATP products to block future attacks. The malware is also submitted to SonicWall Capture Labs for further analysis and added to the Gateway Anti-Virus and IPS databases, as well as URL, IP, and domain reputation databases within 48 hours.

Reporting and Alerts
The SonicWall Capture ATP provides an at-a-glance threat analysis dashboard and reports, which detail the analysis results for files sent to the service, including source, destination and a summary plus details of malware action once detonated.

File Types Supported: .cpl .dll .drv .exe .elf .ocx .scr .sys .doc .dot .wbk .docx .docm .dotx .dotm .docb .xls .xlt .xlm .xlsx .xlsm .xltx .xltm .xlsb .xla .xlam .xll .xlw .ppt .pot .pps .pptx .pptm .potx .potm .ppam .ppsx .ppsm .sldx .sldm .o .dylib .bundle .dmg .pdf .jar .apk .rar .bz2 .bzip2 .7z .xz .gz .zip