Capture ATP Service

Suspicious files are sent to the cloud for analysis with the option to hold them at the gateway appliance until a verdict is determined. The multi-engine sandbox platform, which includes virtualised sandboxing, full system emulation and hypervisor level analysis technology, executes suspicious code and analyses behavior. When a file is identified as malicious, a hash is immediately created within Capture and later a signature is sent to firewalls to prevent follow-on attacks.

The solution scans traffic and extracts suspicious code for analysis, but unlike other gateway solutions, analyses a broad range of file sizes and types. Global threat intelligence infrastructure rapidly deploys remediation signatures for newly identified threats to all SonicWall network security appliances, thus preventing further infiltration.

SonicWall Capture Labs

The dedicated SonicWall Capture Labs threats research team researches and develops countermeasures to deploy to customer firewalls for up-to-date protection. The team gathers data on potential threat data from several sources including our award-winning network sandboxing service, Capture Advanced Threat Protection, as well as more than 1 million SonicWall sensors located around the globe that monitor traffic for emerging threats. It is analysed via machine learning using SonicWall's Deep Learning Algorithms to extract the DNA from the code to see if it is related to any known forms of malicious code.

SonicWall NGFW customers with the latest security capabilities are provided continuously updated threat protection around the clock. New updates take effect immediately without reboots or interruptions. The signatures on the appliances protect against wide classes of attacks, covering up to tens of thousands of individual threats with a single signature.