SonicWall Capture Advanced Threat Protection Service – 1-Year Subscription

Protect your SonicWall TZ series firewall with cloud-based, autonomous threat analysis that identifies and blocks malware, ransomware, and zero-day exploits before they reach your network. SonicWall Capture Advanced Threat Protection (ATP) is designed to integrate seamlessly with TZ270 and other TZ models, delivering proactive defense through sandboxing, threat intelligence, and automated remediation. This 1-year subscription license provides ongoing updates, support, and policy-based protection, helping security teams stay ahead of evolving threats while minimizing impact on performance and user productivity. With TA A-compliant delivery and scalable coverage, Capture ATP is the trusted choice for small to enterprise networks seeking comprehensive, hands-off threat prevention.

• Cloud-powered sandboxing and threat analysis — Capture ATP analyzes suspicious content and files in a secure, isolated sandbox to reveal malicious behavior that traditional signature-based systems might miss. By detonation in a safe virtual environment, it uncovers advanced threats, behavioral indicators, and command-and-control patterns, then returns actionable verdicts to your firewall to stop threats in their tracks.
• Real-time threat intelligence and rapid remediation — Leveraging SonicWall’s Global Threat Network, ATP receives up-to-the-minute IOC data, indicators of compromise, and machine-learning-driven analytics. This enables near-instant blocking of new malware families and zero-day exploits, reducing dwell time and providing faster incident response for security operations teams of any size.
• Flexible licensing for TZ-series deployments — This is a 1-user, 1-year subscription license that plugs directly into supported TZ appliances (including TZ270) and scales with your network. It simplifies procurement and renewal, ensuring continuous protection without up-front hardware changes. The license is designed to align with enterprise procurement processes while remaining accessible for small- to mid-sized deployments.
• Seamless on-device integration and policy control — Activation and policy configuration are performed through the SonicWall management console, with intuitive controls for sandbox submission, file types to analyze, and action thresholds. IT teams can tailor ATP behavior to balance security with user productivity, enabling aggressive protection for sensitive segments and lighter scrutiny where appropriate.
• Enhanced protection for encrypted traffic and broader security coverage — ATP supports analyzing encrypted traffic and integrates with your SSL/TLS inspection strategy to detect threats hidden in transit. Combined with SonicWall’s broader security stack, it provides multi-layer defense, centralized visibility, and comprehensive reporting that helps meet compliance needs and security posture goals.

Technical Details of SonicWall Capture Advanced Threat Protection Service

• Licensing and duration — 1 Year, 1 License per device, subscription-based renewal model.
• SKU compatibility — 02-SSC-2821, 02-SSC-6447, 02-SSC-6841, 02-SSC-6843, 02-SSC-7305 (representing various regional or reseller configurations).
• Compatibility — Designed for SonicWall TZ-series firewalls, including TZ270, with scalable deployment across additional TZ models as needed.
• Compliance — TAA Compliant, suitable for government-related purchases and procurement requirements in supported regions.
• Delivery and activation — Cloud-based service activated through the SonicWall management interface; no extra hardware required, with automatic updates and threat intelligence feeds.

how to install SonicWall Capture Advanced Threat Protection

Installing SonicWall Capture ATP on a TZ-series firewall is a straightforward process designed to minimize downtime while maximizing security. The steps below outline a typical deployment workflow from activation to policy tuning, ensuring you get the most out of ATP's capabilities.

• Prerequisites — Ensure your TZ270 or supported TZ device is online and running compatible firmware. Have your 1-year license activation key ready, along with administrator access to the SonicWall management console. Validate that your network design allows traffic to be submitted for cloud-based analysis as required by your security policy.
• Access the management console — Log in to the SonicWall management interface using an administrator account. Navigate to the Security Services or Capture ATP section, depending on your firmware version and device model.
• Activate the ATP license — In the licensing area, enter the activation key associated with your 1-year Capture ATP subscription. Confirm activation and allow the portal to synchronize with the cloud service, ensuring your device is registered for ATP and is receiving updates.
• Configure submission and analysis policies — Specify the file types and traffic categories that should be analyzed by the cloud sandbox. Define submission rules (automatic or on-demand), and set your preferred action for detected threats (block, alert, quarantine). If you intend to inspect encrypted traffic, integrate ATP with your SSL/TLS inspection policy and ensure privacy and compliance requirements are met.
• Enable reporting and logging — Activate detailed alerts, activity logs, and dashboards to track ATP activity, detections, and remediation actions. Configure periodic reports for security teams or executives and integrate ATP data with your SIEM or logging platform as needed.
• Test and validate — Run non-production traffic or a controlled test to confirm that files are being submitted to the cloud sandbox and that the firewall enforces the expected responses. Review sandbox verdicts and adjust policy thresholds to balance protection with user experience.
• Ongoing tuning and renewal — Monitor threat landscape, adjust submission rules for new file types, and renew the ATP license before expiration to maintain continuous protection. Schedule quarterly reviews of protection effectiveness and policy effectiveness with your security team.

Frequently asked questions

What is SonicWall Capture Advanced Threat Protection?
SonicWall Capture ATP is a cloud-based threat analysis service that examines suspicious content and files in a secure sandbox to identify malware, ransomware, and zero-day exploits. Integrated with SonicWall TZ-series firewalls, ATP provides automated detection, analysis, and enforcement to block threats before they reach endpoints or users.

How long does the license last?
This product is a 1-year subscription license per device. After the term ends, renewal is required to maintain protection. The licensing model is designed for simple procurement and consistent protection across growing networks without the need for additional hardware.

Which devices are compatible with Capture ATP?
Capture ATP is designed to work with SonicWall TZ-series firewalls, including the TZ270. The included SKUs cover various regional configurations. Ensure your firewall firmware is up to date and that the device is eligible for ATP activation through the management console.

Can ATP inspect encrypted traffic?
Yes, Capture ATP can operate alongside SSL/TLS inspection to analyze traffic encrypted by modern ciphers. Proper policy configuration is required to ensure compliant and privacy-conscious deployment, including trusted certificate management and alignment with your organization’s security posture.

What protections does ATP provide?
ATP analyzes attachments and payloads, detects anomalous behavior in sandboxed environments, and leverages global threat intelligence to identify and block malware, ransomware, and zero-day exploits. It complements file-reputation, signature-based detection, and other SonicWall security services to deliver layered defense and rapid incident response.

How do I renew or upgrade my Capture ATP license?
Licensing is renewal-based. You can renew through the SonicWall management console or your authorized reseller. If your network grows or you add TZ appliances, you may extend ATP coverage by applying additional licenses per device as needed to maintain consistent protection across your environment.