> Source: [sk180701](https://support.checkpoint.com/results/sk/sk180701)

# sk180701 - Attachments downloaded from Microsoft Outlook are not emulated

| Property | Value |
|----------|-------|
| Solution ID | sk180701 |
| Date Created | 2023-03-08 |
| Last Modified | 2023-03-09 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |

## Symptoms

- * Attachments downloaded from Microsoft mail (outlook.office.com) fail to be emulated and prompt to download without emulation.
* The log file `harmony_web_protection.log` shows:  
  `LEVEL: AUTOMATION | MODULE: FILE_DOWNLOAD | SESSION: download_session_id | MESSAGE: "handle file download" | PARAMS: {"download_id":id,"url":"blob:https://outlook.office.com/attachment_id"} `  
  `LEVEL: INFO | MODULE: ANALITICS | SESSION: analytic_session_id | MESSAGE: "trackAction send" | PARAMS: `  
  `{"id":id,"category":"File stats","action":"Detect download","label":"extension"} `  
  `LEVEL: INFO | MODULE: ANALITICS | SESSION: analytic_session_id | MESSAGE: "trackAction send" | PARAMS: `  
  `{"id":id,"category":"File stats","action":"Size of file that passed size limit check","value":296960,"customVar5Key":"max_file_size","customVar5Val":15000000} `  
  `LEVEL: INFO | MODULE: UI_NOTIF | SESSION: analytic_session_id | MESSAGE: "Download notification data" | PARAMS: `  
  `{"downloadId":id,"notification_id":id,"progress:":5} `  
  `LEVEL: INFO | MODULE: FILE_DOWNLOAD | SESSION: download_session_id | MESSAGE:`  
  `"check_connection_and_download_file isCancelDownloadBeforeConnectivityCheck : undefined" | PARAMS: {} `  
  `LEVEL: INFO | MODULE: MAIN | SESSION: analytic_session_id> | MESSAGE: "testing connectivity" | PARAMS:`  
  `{"mode":"cloud","tpProtocol":"cloud","server_addr":"te.iaas.checkpoint.com","api_key":"api_key"} `  
  `LEVEL: INFO | MODULE: ANALITICS | SESSION: analytic_session_id | MESSAGE: "trackAction send" | PARAMS: `  
  `{"id":id,"category":"File stats","action":"Check connectivity","label":"ok","value":335,"customVar5Key":"file_extension","customVar5Val":"xls"} `  
  `LEVEL: INFO | MODULE: FILE_DOWNLOAD | SESSION: download_session_id> | MESSAGE: "getting file from URL using method" | PARAMS:`  
  `{"download_id":id,"file_name":"file_name.extension","url":"blob:https://outlook.office.com/attachment_id","content_type":"application/octet-stream","method":"GET"} `  
  `LEVEL: INFO | MODULE: UI_NOTIF | SESSION: analytic_session_id | MESSAGE: "Download notification data" | PARAMS: `

## Cause

Microsoft changed the processes for storing and downloading attachments from direct access links to the attachments. It now uses blob data with dynamic links for the attachments.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content