Capture ATP for SMA is a cloud-based advanced threat protection subscription for the SonicWall SMA 6210, 7210, and 8200v. It intercepts files uploaded by remote users through the SMA portal, quarantines them, and submits them to a four-engine cloud sandbox before releasing or blocking them. The four engines are RTDMI, virtualized sandboxing, full system emulation, and hypervisor-level analysis.

Capture ATP scans PE executables, DLLs, PDFs, Microsoft Office documents, archives, JAR files, and APK files across Windows and Android platforms. Administrators can customize which file types are submitted based on file type, size, sender, recipient, or protocol. Files can also be submitted manually for analysis.

RTDMI, or Real-Time Deep Memory Inspection, is SonicWall's patented technique for detecting threats that evade traditional sandbox analysis. Evasion-first malware is designed to detect sandbox environments and stay dormant until it reaches a live system. RTDMI forces the malware to reveal its payload in CPU memory at execution time, catching threats that appear clean under behavioral analysis. For SMA deployments, this matters because remote users uploading files are an entry point for exactly these kinds of targeted, evasion-aware threats.

Files are held in quarantine during analysis. For most common file types a verdict is returned in seconds. Files that match known-clean signatures in SonicWall's threat intelligence database can be cleared immediately without a full sandbox run. Administrators can configure policy to allow specific low-risk file types to bypass the queue entirely, or to enforce block-until-verdict for all submissions depending on the organization's risk tolerance.

Capture ATP for SMA is compatible with the SMA 6210, SMA 7210, and SMA 8200v running SMA OS 12.4 or later. It is an optional subscription add-on. SMA appliances provide full remote access functionality without it. It becomes relevant when your security policy or compliance framework requires file-level inspection of content that remote users upload into the corporate network.

When Capture ATP identifies a new malicious file, SonicWall immediately generates a signature and publishes it to all Capture ATP subscribers globally. This means every other organization with a Capture ATP subscription is protected from that threat before it can reach a second target. The threat is also logged in your appliance's threat analysis dashboard with source, destination, and classification details.