WSA using 3rd party Sandbox

[M.Hump]

Hi is it possible to use a 3rd party sandbox with a WSA?  I'm wanting to use a FireEye Sandbox as we already have a license, If so can anyone point me in the direction on how to configure this.  I have looked around and can’t find anything on this.

Please Help

Thanks

[Mike_fbr]

I would appreciate if someone could comment on whether any 3rd party sandbox integration was achieved with WSA through ICAP. 

in my case I need to integrate with a Check Point sandbox.

[amojarra]

@Mike_fbr 

As far as your External DLP supports ICAP or Secure ICAP, there will be no issues is integrating your DLP solution with WSA.

https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa-15-2/user-guide/swa-userguide-15-2/m-network-security.html#task_1206267

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++     If you find this answer helpful, please rate it as such    ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[Mike_fbr]

Hi Amirhossein! Thanks for your reply.

The integration I am asking about is not with an external DLP solution, but with an external 3rd party SANDBOXING solution through ICAP.

[amojarra]

Thanks for the clarification Mike

Regarding the external Sandboxing, we do not have this feature. we have Cisco File Analysis as our SandBoxing solution and the ICAP service is only for Upload traffic and is for External DLP.

We can file a feature request, for sure, this needs further analysis and studies, such as, upload conditions, checks, and workflow in case of malicious file detection, synchronization between multiple WSAs and/or SandBoxes cluster and ... .  

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++     If you find this answer helpful, please rate it as such    ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++