Cisco Cisco Content Security Management Appliance M1070 Mode D'Emploi

5-23

AsyncOS 8.3.6 for Cisco Content Security Management User Guide

Chapter 5 Using Centralized Web Reporting and Tracking

Web Reporting Page Descriptions

Viewing File Reputation Filtering Data in Other Reports

Data for file reputation and analysis is available in other reports where relevant. A "Blocked by
Advanced Malware Protection" column may be hidden by default in applicable reports. To display
additional columns, click the Columns link below the table.

The Report by User Location includes an Advanced Malware Protection tab.

Client Malware Risk Report

The Web > Reporting > Client Malware Risk page is a security-related reporting page that can be used
to monitor client malware risk activity.

From the Client Malware Risk page, a system administrator can see which of their users are encountering
the most blocks or warnings. Given the information gathered from this page, the administrator can click
on the user link to view what this user doing on the web that makes them run into so many blocks or
warnings and setting off more detections than the rest of the users on the network.

Additionally, the Client Malware Risk page lists client IP addresses involved in frequent malware
connections, as identified by the L4 Traffic Monitor (L4TM). A computer that connects frequently to
malware sites may be infected with malware that is trying to connect to a central command and control
server and should be disinfected.

File Analysis

Displays the time and verdict (or interim verdict) for each file sent for
analysis.

To view more than 1000 File Analysis results, export the data as a .csv file.

Drill down to view detailed analysis results, including the threat
characteristics and score for each file.

You can also search the cloud service for additional information about an
SHA. The link is on the result details page.