Which process is responsible for communication with the Check Point ThreatCloud for the sake of Anti-Virus Protection Update?

The pslavd (PSL AV-Daemon) is the primary process for the Check Point Anti-Virus software blade. This daemon is responsible for the core functions of the Anti-Virus engine, which includes managing, loading, and utilizing the malware signature database. As part of its duties, pslavd communicates with the Check Point ThreatCloud infrastructure to download and apply the latest Anti-Virus signature updates. This ensures the Security Gateway is equipped with the most current protections against emerging threats.

A. The CPAS Daemon (cpasd): This process is part of the Content Awareness blade and handles the active streaming of data for inspection; it is not responsible for Anti-Virus signature updates.
B. The Resource Advisor Daemon (RAD): This daemon's function is to monitor system resources (e.g., CPU, memory) to maintain gateway stability under heavy load, not to manage security updates.
D. The Threat Emulation Daemon "ted": This process is specific to the Threat Emulation blade and communicates with the ThreatCloud for file sandboxing, not for downloading Anti-Virus signatures.

1. Check Point SecureKnowledge sk111969 - "ATRG: Anti-Virus": This Advanced Technical Reference Guide identifies the key processes for the Anti-Virus blade. In the "Processes and Daemons" section, pslavd is listed as the "PSL AV-Daemon," confirming it as a central process for the blade's operation.

2. Check Point SecureKnowledge sk98322 - "How to troubleshoot Anti-Virus updates": This article provides debugging commands for Anti-Virus update issues. The troubleshooting steps involve interacting directly with the pslavd daemon (e.g., using pslavdadmin -d), which confirms its direct involvement in the update process.

3. Check Point R81.10 Threat Prevention Administration Guide: In the "Anti-Virus" chapter, the guide details the update mechanism, stating that "The Security Gateway gets Anti-Virus signature updates from the Check Point ThreatCloud." The pslavd daemon is the process that executes this function for the Anti-Virus blade.