Ok SandStorm is showing me all the amazing *** it can do but I have no visibility what it blocked nor can I turn it off, is this normal?

Question

Ok it showed 52 amazing blocks but then I don't see what it blocked, I can't buy it since I am home lic and no opportunity is presented to purchase that protection (unlike Untangle UTM which allows home usage with all capability for $50 a year...which I don't mind paying if I could). 
 
 So where are the 52 known suspects?! Is this yet another broken BS that is XG17?! 
 
 I mean hell, the fact that I can not disable IDS rules and then this, I mean XG17 is 3 years old now...wtf, the basic functions are missing!!!!!

Michael Dunn · Answer

This is saying you downloaded (or emailed) 52 files that are suspicious - they are either executable or documents containing executable code - and they would have been analyzed by Sandstorm. 
 
 In your current configuration (no Sandstorm) these file were allowed through the system. If you had a sandstorm licence they would have been analyzed in the sandbox (think of it like super-virus-scan) and then either allowed or blocked. 
 
 The Sandstorm Activity page shows all analysis that was performed. Since you don't have sandstorm, you have never sent anything to be analyzed, and it is empty. 
 
 Tracking down the files that are eligible but not sent to Sandstorm is not ideal but here is a way. 
 Start up the log viewer (top right link). Switch to the Sandstorm log. You will see an entries saying "eligible" but with no details. Unfortunately there are no details unless the file is sent to Sandstorm. Copy the timestamp of the line and paste into the Search box. You should now only be seeing one sandstorm entry. Now switch to viewing the Web Filter log. It will still be filtering for that timestamp, and you can hopefully figure out which request it is. 
 
 If you need to get more exact, hitting the button that says "Detailed View". This will automatically flip you to showing all modules. Add another search term: reason="eligible" 
 The shortcut method of doing this is to start the Log Viewer, switch to Web Filter, and then search for reason="eligible". But I wanted to give the long version so you understand what it is doing.