Cisco Cisco Email Security Appliance C190 Guia Do Utilizador
17-6
Cisco AsyncOS 9.5 for Email User Guide
Chapter 17 File Reputation Filtering and File Analysis
Configuring File Reputation and Analysis Features
Enabling and Configuring File Reputation and Analysis Services
Before You Begin
•
Acquire feature keys for the file reputation service and the file analysis service.
•
Meet the
.
•
Verify connectivity to the update servers configured on the Updates page .
•
If you will use a Cisco AMP Threat Grid Appliance as a private cloud file analysis server, see
.
Procedure
Step 1
Select Security Services > File Reputation and Analysis.
Step 2
Click Enable.
Step 3
Click Edit Global Settings.
Step 4
Select Enable File Reputation.
Step 5
Accept the license agreement if presented.
Step 6
File Analysis is enabled by default. If you do not uncheck Enable File Analysis, the File Analysis
feature key will be activated after the next commit.
feature key will be activated after the next commit.
Step 7
In the File Analysis section, select the file types to send to the cloud for analysis.
Step 8
Adjust the following Advanced Settings for File Reputation as needed:
Note
Do not change any other settings in this section without guidance from Cisco support.
Step 9
If you will use the cloud service for file analysis:
a.
Select Advanced Settings for File Analysis.
b.
Choose the cloud server that is physically nearest to your Email Security appliances .
Newly available servers will be added to this list periodically using standard update processes.
Step 10
If you will use an on-premises Cisco AMP Threat Grid appliance for file analysis:
Configure Advanced Settings for File Analysis:
Option
Description
SSL Communication for File Reputation
Check Use SSL (Port 443) to communicate on port 443
instead of the default port, 32137.
instead of the default port, 32137.
This option also allows you to configure an upstream proxy
for communication with the file reputation service.
for communication with the file reputation service.
Note
SSL communication over port 32137 may require
you to open that port in your firewall.
you to open that port in your firewall.
Reputation Threshold
•
Use value from Cloud Service
•
Enter custom value
The upper limit for acceptable file reputation scores.
Scores above this threshold indicate the file is infected.
Scores above this threshold indicate the file is infected.