Cisco Cisco Web Security Appliance S690 User Guide

Click the relevant SHA-256 link to view web tracking data for all transactions involving that file that 
end users were allowed to access. 

Using the tracking data, identify the users that may have been compromised, as well as information such 
as the file names involved in the breach and the web site from which the file was downloaded. 

Check the File Analysis report to see if this SHA-256 was sent for analysis, to understand the threat 
behavior of the file in more detail. 

In logs: 

AMP

 and 

amp

 refer to the file reputation service or engine.

Retrospective

 refers to verdict updates. 

VRT

 and 

sandboxing 

refer to the file analysis service. 

Advanced Malware Protection information is logged in Access Logs or in AMP Engine Logs. For more 
information, see the chapter on monitoring system activity through logs. 

 

You receive several alerts about failures to connect to the file reputation or analysis services in 

the cloud. (A single alert may indicate only a transient issue.) 

Ensure that you have met the requirements in 

. 

Check for network issues that may prevent the appliance from communicating with the cloud 
services. 

Increase the Query Timeout value: 

Select Security Services > Anti-Malware and Reputation . The Query Timeout value is in the 
Advanced settings area of the Advanced Malware Protection Services section.