SonicWall Capture Security Appliance (CSa) 1000
Skip the cloud. Maintain compliance. Keep complete custody of your files.

Overview:

The SonicWall Capture Security appliance (CSa) brings Capture Advanced Threat Protection (ATP) and sandboxing malware analysis to on-premises deployment scenarios for customers with compliance and policy restrictions against sending files to cloud analysis, or who prefer for all of their data to remain inside their organization. The CSa 1000 can analyze suspicious files coming from other SonicWall products to provide rapid, high accuracy detection of previously unseen threats with the customer retaining custody of their files. Additionally, the REST API functionality on the CSa opens up the benefits of this highly effective file analysis capability to threat intelligence teams, third-party security systems and any software stack that can integrate with published APIs.

The CSa uses a combination of reputation-based checks, static file analysis and SonicWall’s patented Real-Time Deep Memory Inspection (RTDMI) engine for dynamic analysis. This ensures that it provides not only the best possible detection rate of malicious files, but also does this efficiently, in the shortest possible time. The SonicWall ecosystem of security products, already fully integrated with the cloud-delivered Capture ATP analysis, is able to enforce inline security with features such as Block Until Verdict. The same capabilities are supported when the SonicWall products are connected to the CSa series instead of the cloud Capture ATP.

File Inspection in Your Environment

Features:

Deployment Options:

• SonicWall CSa deployment is quick and straightforward, requiring configuration of basic networking, reporting and allowed device access to get started
• The CSa is built to be IP-addressable and can therefore be deployed anywhere, as long as it’s reachable by devices that will submit files for analysis. The CSa can also be deployed in closed or air-gapped networks.

Single Office/Single Location

• The CSa can be deployed anywhere on the network as long as the submission sources that will use it can reach it via an IP.
• Once the CSa is deployed, the firewalls and email security systems (other solutions pending) can be configured to redirect suspicious files to the CSa rather than the cloud for ATP analysis.

Distributed Enterprise/MultipleLocations

• Multiple offices/branches can be configured to share access to a single CSa device, deployed either in the central HQ data center or in a remote datacenter reachable by all devices.
• Access can be direct over the internet or via VPN.
• Mass configuration of SonicWall systems to point to the CSa can be done with either GMS or the cloud-based NSM centralized management solutions for rapid configuration and deployment.

REST API Gateway

• The CSa series has a REST API interface that can be used to submit files for analysis and query results by threat intelligence teams via their own scripts, web-portal integrations and other security products.

Specifications:

Product Specs:	CSa 1000
Features
Reputation & Global Threat Lookup Throughput (Files per hour)1	12,000
Real-World File Mix Throughput (Files per hour)1	2,500
Dynamic Analysis (RTDMI) Throughput (Files per Hour)1	300
Max File Size	100 MB
Maximum Archive Scan Depth	3
REST API Support	Management and File Analysis
SonicWall devices supported	TZ, NSa & SuperMassive (running SonicOS 6.5.4.6/7.0.1 and above)2 Email Security 10.X NSsp 15700 Series NSv Series (7.X and Above)
File types supported	.cpl .dll .drv .exe .elf .ocx .scr .sys .doc .dot .wbk .docx .docm .dotx .dotm .docb .xls .xlt .xlm .xlsx .xlsm .xltx .xltm .xlsb .xla .xlam .xll .xlw .ppt .pot .pps .pptx .pptm .potx .potm .ppam .ppsx .ppsm .sldx .sldm .o .dylib .bundle .dmg .pdf .jar .apk .rar .bz2 .bzip2 .7z .xz .gz .zip
VMs Supported	Windows 7 32/64, Linux 64
Data Retention Period	Unrestricted, limited by storage
Storage	2 x 1TB SSD (RAID 1)
Interfaces	(6)-port 1GE, (2)-port 10Gb SFP+, (2) USB, (1) console
Dedicated Port Management	Yes (X0)
Certifications	FIPS 140-2, ICSA
Product Characteristics
Form factor	1U
Dimensions	17.0 x 16.5 x 1.75 in (43 x 41.5x 4.5 cm)
Appliance Weight	18.3 lbs (8.3 kgs)
Encryption data acceleration (AES-NI)	Yes
MTBF (@ 25°C or 77°F) in hours	129,601
Power	Dual power supply, hot swappable
Input rating	100-240 VAC, 1.79 A
Power consumption	114 W
Total heat dissipation	389 BTU
Environmental	WEEE, EU RoHS, China RoHS
Non-operating shock	110 g, 2 msec
Emissions	FCC, ICES, CE, C-Tick, VCCI; MIC
Safety	TUV/GS, UL, CE PSB, CCC, BSMI, CB scheme
Operating Temperature	0°C to 40°C (32°F to 104° F)
TPM	Yes

1. Analysis throughput dependent on network connectivity, file types and compression levels and may vary from published figures.
2. All TZ series, NSa series and SuperMassive series that can run SonicOS 6.5.4.6 or later. Not supported on SuperMassive 9800 and NSsp 12000 Series.

Documentation:

Download the SonicWall CSa 1000 Datasheet (.PDF)