> Source: [sk132492](https://support.checkpoint.com/results/sk/sk132492)

# sk132492 - Threat Emulation Policy Granularity Manager

| Property | Value |
|----------|-------|
| Solution ID | sk132492 |
| Date Created | 2018-08-02 |
| Last Modified | 2025-08-28 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |

## Solution

### **Introduction**

Starting in Engine Update 7.3, support for Policy Granularity Manager (PGM) was added to Threat Prevention. PGM allows you to configure Threat Prevention behavior when you encounter errors or specific flows. The outcomes of the errors can be configured to **error** , **continue** , **fail-close policy** or **fail-open policy**.

* **Error** - Behaves according to general policy. If fail-close, the file is declared as malicious and dropped with a log entry, if fail-open, the file is declared as benign and passed

<!-- -->

* **Continue** - Behaves as if the error did not occur and continues in the flow, e.g., if the "max files in archive" attribute is set to continue, the archive will be extracted and analyzed even though there are more files than permitted.

<!-- -->

* **Fail-Close Policy** - If there is an error, the file is declared as malicious and dropped with a log entry.

<!-- -->

* **Fail-Open Policy**- If there is an error, the file is declared as benign and passed.

### **Availability**

Support for this feature on a Security Gateway is included in Engine Update 7.3.

### **Configuration Policies**

A file that the Threat Emulation blade failed to emulate can be treated as a malicious file (**fail-close policy** ) or as a benign file (**fail-open policy** ). The configuration is performed through the Threat Emulation Command Line Interface - the *tecli* command. On the **GW**:

* To show the current status of an error, run:

***\[Expert@HostName:0\]# tecli advance error show***

* To treat an error as a malicious file (fail-close policy), run the following command in Expert mode:

***Expert@HostName:0\]# tecli advance error set "Error type" fail_close***

* To treat an error as a benign file (fail-open policy), run the following command in Expert mode:

***\[Expert@HostName:0\]# tecli advance error set "Error type" fail_open***

### **Supported error types**

* File exceeds size limit **(supported on R80.10 and above, Threat Emulation must be in Hold mode**).
* Password protected archives cannot be emulated (refer to [sk112821](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112821) for limitations).
* Max number of files in archive reached
* Archive extraction error
* Max decompression rate limit reached in archive
* Unsupported file type
* Password protected document **(Office and PDF)**

? This policy is not supported on cloud environments.  
? This policy should only be set on both the Emulator and the Gateway.

### **Example**

Note that the description and Error State match the *reason* and verdict in the log. By changing the Error State for a specific error type, you can alter the verdict to Accept or Drop.

![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk132492/Capture1901052342.PNG)

![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk132492/error_log1808080328.png)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content