Configuring Virtual Analyzer Network and Filters

Network Connection

From the Network type drop-down list, select how Virtual Analyzer connects to the network. For information about network types, see Virtual Analyzer Network Types.

If you select the Custom Network type, select a specific port for Virtual Analyzer traffic from the Sandbox port drop-down list and click Configure IPv4 settings to configure the network settings.

If a proxy server is required for the internal Virtual Analyzer to connect to the Internet, select Use a dedicated proxy server from the drop-down list and provide the following information:

• Server address

• Port

• Proxy server requires authentication: If authentication is required, select this check box and type the user name and password.

File Submission Filters

Files: Select the file types to have Virtual Analyzer perform one of the following actions:

• Submit only highly suspicious files

• Submit highly suspicious files and force analyze all selected file types

To reduce the likelihood of false-positive detections, select Do not analyze files found safe by the Certified Safe Software Service.

For details, see Certified Safe Software Service.

URL Submission Filters

By default, URLs found safe are first submitted to the URL pre-filter before submitting to Virtual Analyzer. For messages with safe URLs, you can add one or more subject keywords to filter these messages for Virtual Analyzer submission. Safe URLs in matched messages are sent directly to Virtual Analyzer, bypassing the URL pre-filter.

Keyword: Type a subject keyword and click Add to add the keyword to the list.

To delete a keyword from the list, select an entry and click Delete.

Timeout Setting

Select how long Virtual Analyzer should wait before timing out a submitted object. By default, when the submission timeout is reached, Virtual Analyzer sends out submitted objects waiting in the queue without analysis. Timed out objects still receive risk levels from other scan engines.

You can configure threat protection rules in policies to perform actions on timed out objects.

For more information, see Configuring a Threat Protection Rule.