> For the complete documentation index, see [llms.txt](https://waf-doc.inext.checkpoint.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://waf-doc.inext.checkpoint.com/additional-security-engines/file-security.md).
# File Security
#### Overview
Check Point WAF's File Security engine inspects files uploaded through HTTP traffic to prevent delivery of malicious content. Every uploaded file is:
* Checked against Check Point ThreatCloud for known-malicious reputation.
* Verified by **magic byte (binary signature) inspection** — not by file extension or the `Content-Disposition` header. This check always runs and is not configurable.
* Optionally sent to **Threat Emulation** (sandbox) for behavioral analysis of Office documents, PDFs, and executables.
#### How to Set Up File Security
{% hint style="warning" %}
Enabling File Security — and especially **Threat Emulation** with **Hold request until sandbox verdict is received** — adds processing time to requests carrying file uploads. Use a longer request timeout on the asset, and scope File Security to only the assets that actually accept uploads rather than enabling it globally.
{% endhint %}
**Step 1 — Open the asset's File Security settings** Go to **Policy → Assets**, edit the relevant Web Application / API asset, open the **Web Attacks** tab, and scroll to the **File Security** sub-practice.
**Step 2 — Set the Mode** Choose how File Security enforces on this asset:
| Mode | Behavior |
| ---------------- | -------------------------------------------------- |
| **As Top Level** | Inherits the mode from the parent practice. |
| **Detect** | Logs violations but allows the file through. |
| **Prevent** | Blocks files that violate the configured criteria. |
| **Disable** | Turns File Security off for this asset. |
**Step 3 — Configure File Security settings**
| Setting | Options | Notes |
| ---------------------------------------------------- | --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Activate Protection with Severity Level** | Medium or above, etc. | Minimum severity that triggers File Security action. |
| **High / Medium / Low Confidence** | Prevent / Detect / Inactive / *According to Practice* | Per-confidence-level behavior for reputation and signature matches. *According to Practice* inherits the behavior from the top-level practice mode set in Step 2. |
| **Extract Archive Files** | On / Off | Scans inside archive files instead of treating the archive as one opaque file. |
| ↳ Scan up to *N* MB | numeric + MB/GB | Size limit for content scanned *inside* an archive. |
| ↳ Archived files within archived files | Prevent / Detect / Inactive / According to Practice | Behavior for nested archives (archive-in-archive). |
| ↳ Archived files where content extraction failed | Prevent / Detect / Inactive / According to Practice | Behavior when an archive can't be unpacked (corrupt, encrypted, unsupported). |
| **Files exceeding** *N* MB | numeric + MB/GB → Prevent / Detect / Inactive / According to Practice | Behavior for uploads over the configured size limit. |
| **Unnamed files** | Prevent / Detect / Inactive / According to Practice | Behavior for uploads missing a filename in `Content-Disposition`. |
| **Threat Emulation** | On / Off | Sends Word, Excel, PowerPoint, PDF, and executable files to the sandbox for behavioral analysis. |
| ↳ **Hold request until sandbox verdict is received** | On / Off (only selectable when Threat Emulation is on) | **New.** When enabled, the request is held until Threat Emulation returns a verdict, and a malicious verdict blocks delivery outright. When disabled (default), the request is forwarded immediately and the verdict is logged after the fact. |
{% hint style="info" %}
**Supported archive types:** ZIP, RAR, TAR, 7z, Tar Gzip, Tgz, Gz, Bz2. `⚠️` (confirm whether this list is fixed or may grow, and phrase accordingly)
**Note:** Changing any setting away from its Best Practice default prompts you to save it as a new custom practice rather than overwriting the default.
{% endhint %}
**Step 4 — Enforce the policy** Click **Enforce** on the Infinity Portal banner to push the updated policy live.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://waf-doc.inext.checkpoint.com/additional-security-engines/file-security.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.