After you enable inline payload analysis in a policy, you can select how ​SIA​ proxy scans these types of files:

• Small. Files that are less than 5 MB in size.

• Large. Files that are 5 MB to 2 GB in size.

• Huge. Files that are more than 2 GB in size.

In a policy, you select the action that's associated with large and huge file types. By default, with inline payload analysis, small files (files that are less than 5 MB) are always scanned inline or before the file is downloaded.

Inline payload analysis

Organizations that are licensed for ​SIA​ Advanced Threat can enable inline payload analysis to scan content on websites. For example, this feature allows ​SIA​ to scan a file like a PDF or an image.

If the proxy is enabled, you can enable inline payload analysis in a policy.

When inline payload analysis is enabled, malware scanning is performed on responses from the origin server. The HTTP and HTTPS payload from risky domains or files in a file sharing application are scanned. This feature allows the proxy to scan files that are up to 5 MB in size.

Note these points:

• Inline payload analysis is applied to traffic sent through ​SIA​ Proxy.

• With the selective proxy, only risky domains are sent to the proxy. With the full web proxy, all traffic is sent to the proxy.

When you enable inline payload analysis in a policy, you can also define how ​SIA​ handles files that exceed 5 MB. You can configure ​SIA​ to scan large files that are 5 MB to 2 GB in size after they are downloaded. For more information, see Static malware analysis of large files. If you further enable dynamic analysis, you can scan files that are 5 MB to 100 MB in an isolated sandbox environment where files are opened, executed, and observed for harmful activity. For more information, see Dynamic malware analysis.

If the payload analysis detects a threat, the response is blocked or monitored based on the action that's assigned to the malware threat category.

When you enable inline payload analysis:

• You can also choose to block or allow files that cannot be scanned by ​SIA​ Proxy. Unscannable files are files that are encrypted or compressed. By default, this setting is disabled and these files are allowed in your enterprise.

• ​SIA​ also analyzes websites for zero-day phishing threats. With this feature, ​SIA​ can detect webpages that were created with phishing toolkits. For more information, see Zero-day phishing detection.

You can also use inline payload analysis for DLP. With DLP, you can scan data that's uploaded by users and is up to 5 MB in size. DLP scans this data for sensitive information. For more information, see Data loss prevention.

Static malware analysis of large files

While inline payload analysis allows ​SIA​ Proxy to scan files or website content that's up to 5 MB in size, ​SIA​ Proxy cannot scan files that exceed 5 MB inline or before it's downloaded to the user's browser. In ​SIA​, you define how larger files are handled. You can allow or block the download of these larger files. If these files range from 5 MB to 2 GB in size, you can configure ​SIA​ Proxy to scan these files out of band or after they are downloaded to the browser.

Static malware analysis of large files scans files offline or after they are downloaded by the end user. Static malware analysis scans the code without running or executing it. This feature is enabled when you select the Allow and Scan action for large files. These files are scanned with the same static analysis engines as small files.

If you want to analyze content when it's executed in a secure, sandbox environment with dynamic scanners, see Dynamic malware analysis. If files scanned with static malware analysis are considered suspicious and dynamic analysis is also enabled in the policy, these files are automatically analyzed in the sandbox environment with dynamic analysis.

Files are scanned within a four hour period after download. If ​SIA​ Proxy detects malware, a threat event is reported in ​SIA​.

Because the scan occurs after the file is downloaded, the malicious file is not blocked. As a result, you may need to run an anti-virus scan on the machine where the file was downloaded or configure your organization's security information and event management (SIEM) solution to scan the machine for malware.

📘

To enable or use this feature, your organization needs to be licensed for Advanced Sandbox.

Dynamic malware analysis

If your enterprise is licensed for the Sandbox module and you selected the Allow and Scan action for large files, you can enable dynamic malware analysis. This feature scans files in a secure sandbox environment that's isolated from your network. Files are automatically scanned offline or after the file is downloaded.

📘

Currently, dynamic analysis scans files or content that range from 5 MB to 100 MB in size.

Unlike static malware analysis that scans file contents, dynamic malware analysis opens and executes the files in an isolated sandbox environment and observes whether harmful actions are detected. Sandbox thoroughly analyzes these files using a number of reverse engineering techniques to test how the files behave.

The sandbox environment:

• Scans files offline (after the file is downloaded).

• Uses advanced detection technology to analyze files and circumvent malware evasion techniques.

• Executes or launches suspicious code within the controlled sandbox environment and observes its behavior.

• Generates a report. Any malicious code and URLs are detailed in a deep scan report that's available for download in ​SIA​ reporting.

• Data from analysis is used to identify malware in real time. This data can be used to identify malware with the same or similar code. For example, dynamic malware analysis can potentially identify zero-day phishing threats.

📘

This feature is available to organizations that are licensed for the Advanced Sandbox module.

If you enable dynamic malware analysis to scan files in a sandbox environment, it also scans files as part of inline payload analysis. Files that are scanned with static malware analysis and are considered suspicious are also scanned within the sandbox environment when the dynamic analysis feature is enabled.

If a threat is detected in the sandbox environment, a deep scan report with test and scan results is available with the associated threat event. You can download the report in PDF format. For more information, see Deep scan report for dynamic malware analysis.

📘

If scanned content uses a one-time token or a one-time URL, the token or URL may expire, or it may be used in the sandbox environment. As a result, a user's experience is interrupted when they attempt to access this content. To resolve this issue, the end user can initiate the request or download again. An ​SIA​ administrator can also add the domains for these requests to an exception list.

Deep scan report

If Dynamic Analysis is enabled and a threat was detected for a file that is 5 MB to 100 MB, a deep scan report in PDF format is available for download in ​SIA​. You can download the report from the associated threat event. The report is available for download for 30 days.

The deep scan report details the results of scans completed in the sandbox environment. Depending on the type of content that's analyzed and the scan results, the report may contain this data.