> Source: [sk101553](https://support.checkpoint.com/results/sk/sk101553) # sk101553 - Check Point Document Threat Extraction Technology | Property | Value | |----------|-------| | Solution ID | sk101553 | | Date Created | 2014-07-13 | | Last Modified | 2025-10-10 | | Technical Level | General | | Products | Security Gateway | | Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Solution ### Threat Extraction Overview Threat Extraction is a technology that removes potentially malicious features that are known to be risky from files (macros, embedded objects and more). This is a new approach for Threat Prevention: instead of determining whether a file is malicious or not, Threat Extraction cleans the file *before* it enters the organization. Threat Extraction prevents both known and unknown threats *before* they arrive to the organization, thus providing better protection against zero-day threats. This approach is considerably quicker than sandboxing the file with Threat Emulation, so has a much lower impact on user experience. Because of different file type support, Threat Extraction should always be used in combination with Threat Emulation. **Important**: since R80.30, Threat Extraction supports HTTP/HTTPS. ### Supported file formats Threat Extraction supports the following primary file formats. Many other formats (such as Windows Metafile) that are commonly associated with these primary formats are also supported. |---------------------------------------|--------------------------------------------|-----------------|-----------------------------------------------------------|--------------------| | Format | Extensions | mail/Web/Both\* | Supported Methods | Recommended Method | | Adobe FDF | *fdf* | *Both* | *Extract/Convert to PDF* | *Extract* | | Adobe PDF (all versions) | *pdf* | *Both* | *Extract/Convert to PDF* | *Extract* | | Microsoft Docfile | *Microsoft Visio, Microsoft Project, etc.* | *mail* | *Extract/Convert to PDF* | *Extract* | | Microsoft Excel 2007 and above | *xlsx, xlsb, xlsm, xltx, xltm, xlam* | *Both* | *Extract/Convert to PDF* | *Extract* | | Microsoft Excel 2007 Binary | *xlsb* | *Both* | *Extract/Convert to PDF* | *Extract* | | Microsoft Excel 97 - 2003 | *xls* | *Both* | *Extract/Convert to PDF* | *Extract* | | Microsoft PowerPoint 2007 and above | *pptx, pptm, potx, potm, ppam, ppsx, ppsm* | *Both* | *Extract/Convert to PDF* | *Extract* | | Microsoft PowerPoint 97 - 2003 | *ppt, pps, pot, ppa* | *Both* | *Extract/Convert to PDF* | *Extract* | | Microsoft Word 2007 and above | *docx, docm, dotx, dotm* | *Both* | *Extract/Convert to PDF* | *Extract* | | Microsoft Word 97 - 2003 | *doc, dot* | *Both* | *Extract/Convert to PDF* | *Extract* | | Rich Text Format | *rtf* | *Both* | *Extract\*/Convert to PDF \* From R80.40 Engine update 2* | *Extract
* | | Compressed graphic Format JPEG | *jpeg,jpg,jpe,jfif* | *mail* | Extract/Convert to PDF | *Extract* | | Multi Picture Format File | *mpo* | *mail* | Convert to PDF | *Bypass* | | Ichitaro word proccessing application | *jtd* | *mail* | Convert to PDF | Bypass | | Hanword | *hwp* | *mail* | Convert to PDF | Bypass | | Graphics interchange Format | *gif* | *mail* | Extract/Convert to PDF | Extract | | Tagged Image File Format | *tif,tiff* | *mail* | Extract/Convert to PDF | Extract | | Portable Network Graphics | *png* | *mail* | Extract/Convert to PDF | Extract | | bitmap image file | *bmp* | *mail* | Extract/Convert to PDF | Extract | | Device independent Bitmap file | *dib* | *mail* | Convert to PDF | Bypass | | Encapsulated Postscript file | *eps* | *mail* | Convert to PDF | Convert to PDF | | adobe Photoshop Document | *psd* | *mail* | Convert to PDF | Bypass | | Targa Graphic | *tga* | *mail* | Convert to PDF | Bypass | | Paintbrush bitmap image file | *pcx* | *mail* | Convert to PDF | Bypass | | DICOM image | *dcm* | *mail* | Covnert to PDF | Bypass | | JavaScript File | *js* | *mail* | Convert to PDF | Bypass | | Extensible Markup Language | *xml* | *mail* | Convert to PDF | Bypass | | Plain Text file | *txt* | *mail* | Convert to PDF | Bypass | | Hypertext Markup Language | html | *mail* | Convert to PDF | Bypass | To experience this new technology, you may submit files to [SandBlast Analysis Page](http://threatemulation.checkpoint.com) by sending them to [threats@checkpoint.com](mailto:threats@checkpoint.com). ### Important Notes * Threat Extraction blade is supported on Security Gateway in VSX mode in R80.10 or above. * Threat Extraction processes files over these protocols: * over SMTP in MTA mode * over HTTP / HTTPS in Browser Extensions and in [Sandblast Agent](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108695) * Starting from R80.30, Threat Extraction support HTTP/S extraction "inline" without the SandBlast Agent for Browsers browser extension. ### Digital signatures * On MTA mode it is possible to clean signed emails. on Threat Prevention profile under mail -\> Exceptions -\> signed email attachments -\> change to "clean". * The mails will have the attachments in them cleaned, The mail itself will contain the signature which will now be invalid. * in General Threat Extraction does not support Extraction on all supported files with digital signatures. * PDFs with Digital signatures Will have the following behavior: 1. If the file contains Encrypted objects with a digital signatures and the document contains objects that Threat Extraction should remove, an error will be seen on SmartConsole Log indicating it. on MTA mode and Threat Extraction for web, Threat emulation will scan the file, and only if its benign the original will arrive to the end user. 2. If the file contains Encrypted objects with a digital signatures and the docuement does not contain objects that Threat Extraction should remove, the original will arrive to the end user with no errors. 3. If the file contains digital signature without encrypted objects, the file will be cleaned and the Digital signature will be broken - end user will see a warning that someone tampered with the documents. **Related solution** : [sk112240 - How to add support for new file types in Threat Extraction](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112240) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content