Cisco Cisco Content Security Management Appliance M1070 Mode D'Emploi

Data for file reputation and analysis is available in other reports where relevant. A "Blocked by 
Advanced Malware Protection" column may be hidden by default in applicable reports. To display 
additional columns, click the Columns link below the table. 

The Report by User Location includes an Advanced Malware Protection tab. 

If you have deployed public-cloud File Analysis, you can view detailed results for all files uploaded from 
any managed appliance that has been added to the appliance group for File Analysis. 

File Analysis 

Displays the time and verdict (or interim verdict) for each file sent for 
analysis. The appliance checks for analysis results every 30 minutes. 

To view more than 1000 File Analysis results, export the data as a .csv file.

For deployments with an on-premises Cisco AMP Threat Grid Appliance: 
Files that are whitelisted on the Cisco AMP Threat Grid appliance show as 
"clean." For information about whitelisting, see the AMP Threat Grid online 
help. 

Drill down to view detailed analysis results, including the threat 
characteristics and score for each file. 

You can also view additional details about an SHA directly on the server that 
performed the analysis by searching for the SHA or by clicking the Cisco 
AMP Threat Grid link at the bottom of the file analysis details page. 

To view details on the server that analyzed a file, see 

If a file extracted from a compressed or archived file is sent for analysis, only 
the SHA value of the extracted file is included in the File Analysis report.

AMP Verdict Updates 

Lists the files processed by this appliance for which the verdict has changed 
since the transaction was processed. For more information about this 
situation, see the documentation for your Web Security appliance. 

To view more than 1000 verdict updates, export the data as a .csv file.

In the case of multiple verdict changes for a single SHA-256, this report 
shows only the latest verdict, not the verdict history. 

If multiple Web Security appliances have different verdict updates for the 
same file, the result with the latest time stamp is displayed. 

Clicking an SHA-256 link displays web tracking results for all transactions 
that included this SHA-256 within the maximum available time range, 
regardless of the time range selected for the report. 

To view all affected transactions for a particular SHA-256 within the 
maximum available time range (regardless of the time range selected for the 
report), click the link at the bottom of the Malware Threat Files page.