Cisco Cisco Firepower Management Center 4000

Page of 1844
 
5-36
FireSIGHT System User Guide
 
Chapter 5      Managing Reusable Objects 
  Working with File Lists
The File List pop-up window appears.
Step 2
Next to the SHA-256 value you want to edit, click the edit icon (
).
The Edit SHA-256 pop-up window appears.
Tip
You can also delete files from the list. Next to the file you want to remove, click the delete icon (
).
Step 3
Update the 
SHA-256
 value or 
Description
Step 4
Click 
Save
.
The File List pop-up window appears. The system updates the file entry in the list.
Step 5
Click 
Save
Step 6
Reapply all access control policies with file policies that use the file list.
After the policies apply, the system no longer performs malware cloud lookups on files in the file list.
Downloading a Source File from a File List
License: 
Malware
Supported Devices: 
Series 3, Virtual, X-Series, ASA FirePOWER
Supported Defense Centers: 
Any except DC500
You can view, download, or delete existing source file entries on a file list. Note that you cannot edit a 
source file once uploaded. You must first delete the source file from the file list, then upload an updated 
file. For more information on uploading a source file, see 
.
The number of entries associated with a source file refers to the number of distinct SHA-256 values. If 
you delete a source file from a file list, the total number of SHA-256 entries the file list contains 
decreases by the number of valid entries in the source file.
To download a source file:
Access: 
Admin/Network Admin
Step 1
On the object manager’s File List page, click the edit icon (
) next to the clean list or custom detection 
list where you want to download a source file.
The File List pop-up window appears.
Step 2
Next to the source file you want to download, click the view icon (
).
The View SHA-256’s in list pop-up window appears.
Step 3
Click 
Download SHA List
 and follow the prompts to save the source file. 
Step 4
Click 
Close
.
The File List pop-up window appears.