Enable On-Box Sandboxing on Content Analysis System

Products

• Content Analysis Software - CA
• Advanced Secure Gateway Software - ASG

Issue/Introduction

If On-Box Sandboxing is not active on CAS S400 and S500

Environment

When you enable on-box sandboxing, you have the option of immediately downloading the Windows base image so that you can set up a virtualized Windows environment for sandboxing.

Depending on your network, the download process could take a while, so make sure you have sufficient time before beginning.

Resolution

1. Enable your On-box Sandboxing license.

   1. Select System > Licensing.

   2. Select the On-box Sandboxing check box.

      

   3. Read the warning and click OK.

   4. Click Save Changes. A Confirmation dialog asks if you want to create a Windows profile.

      
       

2. If you have time to download the Windows base image now, click Yes. Due to the size of this file, downloading can take quite some time. To perform this task later, click No and then refer to Add Windows Base Image.

3. In the On-box Sandboxing Configuration dialog, begin the download and activation process.
   1. From the Select Image drop-down, select Windows 7 64-bit. 

      

   2. Enter the Microsoft Windows Product Key. The product key is located on the Windows license documentation you received after purchasing the on-box sandboxing license. You may type the key in upper- or lowercase, but you must include the dashes.

      or

      To use a 30-day trial license, select Use Trial Key. (See Convert from Trial to Full Windows License for On-box Sandboxing - check this article )

   3. Click Start Activation. You can monitor the download progress in the On-box Sandboxing Configuration dialog. 

      

      Since the base image is a large file, it will take quite some time to add to Content Analysis, even if it's downloading from the local network.

      After the activation process is complete, the Windows base image will be shown in the Base Images panel and the initial IntelliVM (IVM) profile is listed in the Scanning Profiles panel. The Status column shows Ready. 

      

      If the base image failed to load or Windows didn't activate, the Status column will display a descriptive error message; see Troubleshooting Windows Image Download Issues.



4. Confirm Malware Analysis settings are properly configured.
   1. Select Services > Sandboxing > Blue Coat Malware Analysis.

   2. In the Servers panel, make sure Local Instance is enabled.

      

   3. (optional) Select Submit to SandBox to enable MA's emulation feature. . 

      • Some malware behaves differently when executed in a SandBox environment than a Windows workstation, and that difference can result in some files not being properly identified as malware. However, with only SandBox emulation enabled, MA scanning will be faster and use fewer resources than with IntelliVM profiles.
      • SandBox emulation is the only on-box sandboxing environment available to Content Analysis VA and CAS S200 appliances, so Submit to SandBox must be selected.
      • If you enable SandBox and use IntelliVM profiles, Malware Analysis will execute suspicious files in both environments.
      • For maximum protection, Symantec recommends sending suspicious files to both the MA SandBox as well as the configured IntelliVM profiles.

   4. Save any changes you may have made.