Cisco Cisco Firepower Management Center 2000

Your search results appear in your default malware events workflow, constrained by the current time 
range.

Click 

 if you are modifying an existing search and want to save your changes.

Click 

 to save the search criteria. The search is saved (and associated with your 

user account if you selected 

).

Malware or Any

feature dependent

feature dependent

The system logs malware events to the Defense Center database when:

a managed device detects a file in network traffic that is then identified as malware by a malware 
cloud lookup

a managed device detects a file on the custom detection list in network traffic

the system learns that a file’s malware disposition has changed; these are called retrospective 
malware events

a FireAMP Connector installed on an endpoint in your organization detects a threat and 
communicates that threat to the Cisco cloud

Because FireAMP malware detection is performed at the endpoint at download or execution time, while 
managed devices detect files in network traffic, the information in these malware events is different. 
Retrospective malware events also contain slightly different data than other network-based malware 
events, or endpoint-based malware events.

The following sections briefly describe the different kinds of malware events. For information on the 
overall malware detection process, see 

If your organization has a FireAMP subscription, individual users install FireAMP Connectors on their 
computers and mobile devices. These lightweight agents communicate with the Cisco cloud, which in 
turn communicates with your Defense Center; see 

. The cloud can send notification of threats, as well other kinds of information including data 

on scans, quarantines, blocked executions, and cloud recalls. The Defense Center logs this information 
to its database as malware events.

The IP addresses reported in endpoint-based malware events may not be in your network map—and may 
not even be in your monitored network at all. Depending on your deployment, level of compliance, and 
other factors, endpoints in your organization where FireAMP Connectors are installed may not be the 
same hosts as those monitored by your managed devices.

Series 3, virtual, X-Series

Any except DC500