Cisco Cisco Web Security Appliance S170 Guía Del Usuario
14-14
AsyncOS 9.1.1 for Cisco Web Security Appliances User Guide
Chapter 14 File Reputation Filtering and File Analysis
Troubleshooting File Reputation and Analysis
Step 3
Using the tracking data, identify the users that may have been compromised, as well as information such
as the file names involved in the breach and the web site from which the file was downloaded.
as the file names involved in the breach and the web site from which the file was downloaded.
Step 4
Check the File Analysis report to see if this SHA-256 was sent for analysis, to understand the threat
behavior of the file in more detail.
behavior of the file in more detail.
Related Topics
•
Troubleshooting File Reputation and Analysis
•
•
•
•
•
•
Log Files
In logs:
•
AMP
and
amp
refer to the file reputation service or engine.
•
Retrospective
refers to verdict updates.
•
VRT
and
sandboxing
refer to the file analysis service.
Information about Advanced Malware Protection including File Analysis is logged in Access Logs or in
AMP Engine Logs. For more information, see the chapter on monitoring system activity through logs.
AMP Engine Logs. For more information, see the chapter on monitoring system activity through logs.
In the log message "Response received for file reputation query" possible values for "upload action" are:
•
0: The file is known to the reputation service; do not send for analysis.
•
1: Send
•
2: The file is known to the reputation service; do not send for analysis.
Several Alerts About Failure to Connect to File Reputation or File Analysis
Servers
Servers
Problem
You receive several alerts about failures to connect to the file reputation or analysis services in
the cloud. (A single alert may indicate only a transient issue.)
Solution
•
Ensure that you have met the requirements in
.