> Source: [sk123140](https://support.checkpoint.com/results/sk/sk123140)

# sk123140 - How to configure Threat Emulation blade to block files according to file types

| Property | Value |
|----------|-------|
| Solution ID | sk123140 |
| Date Created | 2018-02-25 |
| Last Modified | 2026-02-22 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81 (EOS) |

## Solution

When using Threat Emulation blade, files can be blocked according to their file types.

A list of prohibited file types can be set on the Security Gateway, and those file types will be blocked ("Detect" or "Prevent" according to policy and configuration), with **high confidence** and **low severity**.

There are several granularities:

* **Protocol** - define on which protocol we want to block the file types. Possible options:
  * web
  * mail
  * all
* **Context** - define on which context the file types will be blocked, whether it arrives inside archive or plain, possible options:
  * plain
  * archive
  * all

**Enabling extracted prohibited file types**

Enabling the prohibited file types feature in **archive**context.

On the Security Gateway, run the following command:

*\[Expert@HostName:0\]# tecli advanced prohibited enable_archive 1*

**Disabling extracted prohibited file types**

Disabling the prohibited file types feature in **archive**context.

On the Security Gateway, run the following command:

*\[Expert@HostName:0\]# tecli advanced prohibited enable_archive 0*

**Enabling plain prohibited file types**

Enabling the prohibited file types feature in **plain** context.

On the Security Gateway, run the following command:

*\[Expert@HostName:0\]# tecli advanced prohibited enable_plain 1*

**Disabling plain prohibited file types**

Disabling the prohibited file types feature in **plain**context.

On the Security Gateway, run the following command:

*\[Expert@HostName:0\]# tecli advanced prohibited enable_plain 0*

**Checking the status of prohibited file types**

To see the list of file types currently configured as prohibited, run the following command:

*\[Expert@HostName:0\]# tecli advanced prohibited show*

**Add prohibited file types**

Add command should get the following arguments, in that exact order:

* **-protocol:** this indicates on which **protocol**the file types will be prohibited, possible options: mail/web/all.
* **-context:** this indicates on which **context**the file types will be prohibited, possible options: plain/archive/all.
* **-types:** non-empty list of file types separated by comma that will be prohibited, \<file_type1\>,\<file_type2\>...

On the Security Gateway, run the following command:

*\[Expert@HostName:0\]# tecli advanced prohibited add -protocol web -context plain -types docm,xlsm*

**Remove prohibited file types**

Remove command should get the following arguments, in that exact order:

* **-protocol:** this indicates on which **protocol**the file types will no longer be prohibited, possible options: mail/web/all.
* **-context:** this indicates on which **context**the file types will no longer be prohibited, possible options: plain/archive/all.
* **-types:** non-empty list of file types separated by comma that will no longer be prohibited,\<file_type1\>,\<file_type2\>...

On the Security Gateway, run the following command:

*\[Expert@HostName:0\]# tecli advanced prohibited remove -protocol web -context plain -types docm,xlsm*

**Example use cases**

* To block every archive that contains "\*.exe" and "\*.js" file via mail, run:  

  * First enable extracted prohibited file types, if disabled:  

    *\[Expert@HostName:0\]# tecli advanced prohibited enable_archive 1*
  * After enabling, run the add command:  

    *\[Expert@HostName:0\]# tecli advanced prohibited add -protocol mail -context archive -types exe,js*

<!-- -->

* To stop blocking archive that contains "\*.js" file via mail, run:

*\[Expert@HostName:0\]# tecli advanced prohibited remove -protocol mail -context archive -types js*

* To block all *docm* file types via web, run:  

  * First enable plain prohibited file types, if disabled:  

    *\[Expert@HostName:0\]# tecli advanced prohibited enable_plain 1*
  * After enabling run the add command:  

    *\[Expert@HostName:0\]# tecli advanced prohibited add -protocol web -context plain -types docm*

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content