Reputation & Global Verdict lookup (configurable). Static analysis & dynamic analysis with RTDMI. Whitelist/Blacklist on hash/domain.
Configurable scheduled reporting. Role-based administration (configurable roles). Management – HTTPS or SSH via dedicated management interface or regular network interface.
SSH console access. Logging & alerting. False positive & false negative reporting with automatic whitelist/blacklist.
Direct connectivity or via VPN (IP Addressable). Closed Network Operation. REST API support for file submission and analysis.
Hardened OS with Secure Boot and chain of trust for anti-tampering. Local logging. SonicWall Capture Security appliance 1000.
The SonicWall Capture Security appliance™ (CSa) brings Capture Advanced Threat Protection™ (ATP) and sandboxing malware analysis to on-premises deployment scenarios for customers with compliance and policy restrictions against sending files to cloud analysis, or who prefer for all of their data to remain inside their organization.. The CSa 1000 can analyze suspicious files coming from other SonicWall products to provide rapid, high accuracy detection of previously unseen threats with the customer retaining custody of their files.
The SonicWall ecosystem of security products, already fully integrated with the cloud-delivered Capture ATP analysis, is able to enforce inline security with features such as Block Until Verdict.. The same capabilities are supported when the SonicWall products are connected to the CSa series instead of the cloud Capture ATP.. RTDMI.
SonicWall’s patent-pending Real-Time Deep Memory Inspection (RTDMI) file analysis engine is a novel method of analyzing suspicious files by monitoring the behavior of an application in memory. RTDMI can see through any obfuscation or encryption techniques that modern malware may deploy to evade network and sandbox analysis, yielding extremely high accuracy detection of attacks borne by documents, executables, archive files and a variety of other file types..