Cisco Cisco Firepower Management Center 4000

Click 

.

The file rule is added to the policy. If you are editing an existing file policy, you must reapply any access 
control policies that use the file policy for your changes to take effect.

Malware

feature dependent

feature dependent

In a file policy, you can set the following advanced options.

Note that because you cannot use a Malware license with a DC500, you cannot use or modify these 
settings. Similarly, because you cannot enable a Malware license on a Series 2 device, you cannot apply 
a file policy with these settings enabled.

Admin/Access Admin

Select 

.

The File Policies page appears.

Click the edit icon (

 ) next to the policy you want to edit.

The File Policy Rule page appears. 

Select the 

 tab.

The Advanced tab appears.

Modify the options as described in the 

 table.

Click 

.

Select this to block files on the custom detection list when 
detected. 

enabled

Select this to allow files on the clean list when detected. 

enabled

Select a threshold value to automatically treat files with that threat 
score or higher as if they are malware. Select 

 to disable 

this.

Note that as you select lower threshold values, you increase the 
number of files treated as malware. Depending on the action 
selected in your file policy, this can result in an increase of 
blocked files.