Vanessa is expecting a very important Security Report. The Document should be sent as an attachment via e-mail. An e-mail with Security_report.pdf file was delivered to her e-mail inbox. When she…

SandBlast Threat Emulation sandboxes suspicious files in a virtual environment during analysis and would typically hold or block delivery - not deliver a content-stripped version of the file to the recipient.

SandBlast Agent is an endpoint-based client installed on user workstations for local threat prevention, not a gateway component that intercepts and reconstructs email attachments in transit.

'Check Point Protect' is not a recognized Check Point SandBlast gateway component related to email attachment inspection or content reconstruction.

SandBlast Threat Extraction (Content Disarm and Reconstruction - CDR) proactively removes exploitable active content - including embedded macros, JavaScript, graphs, linked objects, and hyperlinks - from documents before delivery, producing a safe, clean version. This matches the scenario exactly: Vanessa received the PDF but it was stripped of graphs, tables, and links because the gateway's Threat Extraction blade reconstructed it by removing potentially malicious active content while preserving the static text.