Threat verdicts can change as new information emerges. A file may initially be evaluated as unknown or clean, and the file may therefore be released to the recipient. If the threat verdict changes as new information becomes available, you will be alerted, and the file and its new verdict appear in the AMP Verdict Updates report. You can investigate the point-of-entry message as a starting point to remediating any impacts of the threat.

Verdicts can also change from malicious to clean.

When no dynamic content is found in a file after file analysis, the verdict is Low Risk. The file is not sent for file analysis, and the message continues through the email pipeline.

When the appliance processes subsequent instances of the same file, the updated verdict is immediately applied.

Information about the timing of verdict updates is included in the file-criteria document referenced in Supported Files for File Reputation and Analysis Services.

Evaluation of file reputation and sending of files for analysis occur immediately after anti-virus scanning, regardless of verdicts from previous scanning engines, unless a final action has been taken on the message.

Note

By default, if a message has malformed MIME headers, the file reputation service returns a verdict of “unscannable.” The appliance will also attempt to extract the attachments from this message. If the appliance is unable to extract the attachments, verdict will remain as “unscannable.” If the appliance is able to extract the attachments, the file reputation of the attachments is evaluated. If the attachments are malicious, the verdict is changed from “unscannable” to “malicious.”

Communications between the appliance and the file reputation service are encrypted and protected from tampering.

After a file’s reputation is evaluated:

• If a message does not contain any attachments, the file reputation service will return a verdict of “skipped.”
• If the file is known to the file reputation service and is determined to be clean, the message continues through the workqueue.
• If the file reputation service returns a verdict of malicious, for any attachment in the message, then the appliance applies the action that you have specified in the applicable mail policy.
• If the file is known to the reputation service but there is insufficient information for a definitive verdict, the reputation service returns a reputation score based on characteristics of the file such as threat fingerprint and behavioral analysis. If this score meets or exceeds the configured reputation threshold, the appliance applies the action that you have configured in the mail policy for files that contain malware .
• If the reputation service has no information about the file, and the file does not meet the criteria for analysis (see Supported Files for File Reputation and Analysis Services), the file is considered clean and the message continues through the workqueue.
• If you have enabled the File Analysis service, and the reputation service has no information about the file, and the file meets the criteria for files that can be analyzed (see Supported Files for File Reputation and Analysis Services), then the message can be quarantined (see Quarantining Messages with Attachments Sent for Analysis) and the file sent for analysis. If you have not configured the appliance to quarantine messages when attachments are sent for analysis, or the file is not sent for analysis, then the message is released to the user.
• For deployments with on-premises file analysis, the reputation evaluation and file analysis occur simultaneously. If the reputation service returns a verdict, that verdict is used, as the reputation service includes inputs from a wider range of sources. If the file is unknown to the reputation service, the file the file analysis verdict is used.
• If the file reputation verdict information is unavailable because the connection with the server timed out, the file is considered as Unscannable and the actions configured are applied.

If the file is sent for analysis:

• If the file is sent to the cloud for analysis: Files are sent over HTTPS.
• Analysis normally takes minutes, but may take longer.
• A file that is flagged as malicious after File Analysis may not be identified as malicious by the reputation service. File reputation is determined by a variety of factors over time, not necessarily by a single file analysis verdict.
• Results for files analyzed using an on premises Cisco AMP Threat Grid appliance are cached locally.

For information about verdict updates, see File Threat Verdict Updates.

The reputation service evaluates most file types. File type identification is determined by file content and is not dependent on the filename extension.

Some files with unknown reputation can be analyzed for threat characteristics. When you configure the file analysis feature, you choose which file types are analyzed. New types can be added dynamically; you will receive an alert when the list of uploadable file types changes, and can select added file types to upload.

Details about what files are supported by the reputation and analysis services are available only to registered Cisco customers. For information about which files are evaluated and analyzed, see File Criteria for Advanced Malware Protection Services for Cisco Content Security Products, available from https://www.cisco.com/c/en/us/support/security/email-security-appliance/products-user-guide-list.html. The criteria for evaluating a file’s reputation and for sending files for analysis may change at any time.

In order to access this document, you must have a Cisco customer account with a support contract. To register, visit https://tools.cisco.com/RPF/register/register.do.

You should configure policies to block delivery of files that are not addressed by Advanced Malware Protection.

Note	A file (either in incoming mail or outgoing mail) that has already been uploaded for analysis from any source will not be uploaded again. To view analysis results for such a file, search for the SHA-256 from the File Analysis reporting page.

• Only the SHA that uniquely identifies a file is sent to the reputation service in the cloud. The file itself is not sent.
• If you are using the file analysis service in the cloud and a file qualifies for analysis, the file itself is sent to the cloud.

• Information about every file that is sent to the cloud for analysis and has a verdict of "malicious" is added to the reputation database. This information is used along with other data to determine a reputation score.

  Information about files analyzed by an on premises Cisco AMP Threat Grid appliance is not shared with the reputation service.

• If you have configured your appliance to allow data to be sent to the Sender Base Reputation Service, information about certain files is sent. For details, see information about the AMP cloud in chapter "SenderBase Network Participation" of the Cisco Email Security Appliance Guide

File reputation scanning and file analysis are FIPS compliant.

• All Email Security appliances that use these services must be able to connect to them directly over the internet (excluding File Analysis services configured to use an on-premises Cisco AMP Threat Grid Appliance.)

• By default, communication with file reputation and analysis services .

• By default, communication with file reputation and cloud-based analysis services is routed through the interface that is associated with the default gateway. To route this traffic through a different interface, create a static route for each address in the Advanced section of the Security Services > File Reputation and Analysis page.

• The following firewall ports must be open:

  Firewall Ports	Description	Protocol	In/Out	Hostname	Appliance Interface
  32137 (default) or 443	Access to cloud services for obtaining file reputation.	TCP	Out	As configured in Security Services > Anti-Malware and Reputation, Advanced section, Cloud Server Pool parameter.	Management, unless a static route is configured to route this traffic through a data port.
  443	Access to cloud services for file analysis.	TCP	Out	As configured in Security Services > Anti-Malware and Reputation, Advanced section.

If you will use a Cisco AMP Virtual Private Cloud appliance as a private-cloud file analysis server:

• You can obtain the Cisco Advanced Malware Protection Virtual Private Cloud Appliance documentation, including the Installation and Configuration of FireAMP Private Cloud guide, from http://www.cisco.com/c/en/us/support/security/fireamp-private-cloud-virtual-appliance/tsd-products-support-series-home.html

  Use that documentation to perform the tasks described in this topic.

  Additional documentation is available using the Help link in the AMP Virtual Private Cloud appliance.

• Set up and configure the Cisco AMP Virtual Private Cloud appliance in either “proxy” or “air-gap” (on-premises) mode.
• Ensure the Cisco AMP Virtual Private Cloud appliance software version is 2.2, which enables integration with Cisco Email Security appliance.

• Download the AMP Virtual Private Cloud certificate and keys on that appliance for upload to this Email Security appliance

• Use the Root Certificate option to skip standard validation when the root authority, trusted by the Email Security Appliance, does not sign the tunnel proxy server certificate.

Note	After you have set up the on-premises file-reputation server, you will configure connection to it from this Email Security appliance; see Step 6 of Enabling and Configuring File Reputation and Analysis Services

If you will use a Cisco AMP Threat Grid Appliance as a private-cloud file analysis server:

• Obtain the Cisco AMP Threat Grid Appliance Setup and Configuration Guide and the Cisco AMP Threat Grid Appliance Administration Guide. Cisco AMP Threat Grid Appliance documentation is available from http://www.cisco.com/c/en/us/support/security/amp-threat-grid-appliances/products-installation-guides%20-list.html.

  Use this documentation to perform the tasks described in this topic.

  Additional documentation is available from the Help link in the AMP Threat Grid appliance.

  In the Administration Guide, search for information about all of the following: integrations with other Cisco appliances, CSA, Cisco Sandbox API, ESA, and Email Security Appliances, .

• Set up and configure the Cisco AMP Threat Grid Appliance.

• If necessary, update your Cisco AMP Threat Grid Appliance software to version 1.2.1, which supports integration with Cisco Email Security appliances.

  See the AMP Thread Grid documentation for instructions for determining the version number and for performing the update.

• Ensure that your appliances can communicate with each other over your network. Cisco Email Security appliances must be able to connect to the CLEAN interface of the AMP Threat Grid appliance.
• If you will deploy a self-signed certificate: Generate a self-signed SSL certificate from the Cisco AMP Threat Grid appliance to be used on your Email Security appliance . See instructions for downloading SSL certificates and keys in the administrator’s guide for your AMP Threat Grid appliance. Be sure to generate a certificate that has the hostname of your AMP Threat Grid appliance as CN. The default certificate from the AMP Threat Grid appliance does NOT work.
• Registration of your Email Security appliance with your Threat Grid appliance occurs automatically when you submit the configuration for File Analysis, as described in Enabling and Configuring File Reputation and Analysis Services. However, you must activate the registration as described in the same procedure.

If you plan to use a new public cloud File Analysis service, make sure you read the following instructions to maintain datacenter isolation:

• The existing appliance grouping information is not preserved in the new File Analysis server. You must regroup your appliances on the new File Analysis server.

• Messages that are quarantined to the File Analysis Quarantine are retained until the retention period. After the quarantine retention period, the messages are released from the File Analysis Quarantine, and re-scanned by the AMP engine. The file is then uploaded to the new File Analysis server for analysis but the message is not sent to the File Analysis Quarantine again.

For more details, refer to the Cisco AMP Thread Grid documentation from http://www.cisco.com/c/en/us/support/security/amp-threat-grid-appliances/products-installation-guides -list.html.

• Edit File Analysis Quarantine Settings
• Manually Processing Messages in the File Analysis Quarantine

For information about the centralized File Analysis quarantine, see chapter "Centralized Policy, Virus and Outbreak Quarantine" of the Cisco Email Security Appliance Guide.

You can use X-Headers to mark messages with actions and results of message processing steps. You tag messages with X-Headers in mail policies, then use content filters to choose handling options and final actions for these messages.

Values are case-sensitive.

To send notifications to end users when a suspect attachment or its parent message has been dropped based on file reputation scanning, use an X-header or Custom Header and Content Filters.

If you use centralized management, you can enable Advanced Malware Protection and mail policies at the cluster, group and machine level.

Feature keys must be added at the machine level.

Appliance Groups should not be configured at cluster level.

Ensure that the appliance is configured to send you alerts related to Advanced Malware Protection.

You will receive alerts when:

If you will centralize reporting on a Security Management appliance, see important configuration requirements in the Advanced Malware Protection sections in theemail reporting chapter of the online help or user guide for your management appliance.

Because filenames can easily be changed, the appliance generates an identifier for each file using a Secure Hash Algorithm (SHA-256). If an appliance processes the same file with different names, all instances are recognized as the same SHA-256. If multiple appliances process the same file, all instances of the file have the same SHA-256 identifier.

In most reports, files are listed by their SHA-256 value (in an abbreviated format

Data for file reputation and analysis is available in other reports where relevant. A Detected by Advanced Malware Protection" column may be hidden by default in applicable reports. To display additional columns, click the Columns link below the table.

When searching for file threat information in Message Tracking, keep the following points in mind:

• To search for malicious files found by the file reputation service, select Advanced Malware Protection Positive for the Message Event option in the Advanced section in Web Message Tracking.

• Message Tracking includes only information about file reputation processing and the original file reputation verdicts returned at the time a transaction message was processed. For example, if a file was initially found to be clean, then a verdict update found the file to be malicious, only the clean verdict appears in Tracking results.

  In Message Tracking details, the Processing Details section shows:

  • The SHA-256 of each attachment in the message, and

  • The final Advanced Malware Protection verdict for the message as a whole, and

  • Any attachments which were found to contain malware.

• Verdict updates are available only in the AMP Verdict Updates report. The original message details in Message Tracking are not updated with verdict changes. To see transactions messages that have a particular attachment, click a SHA-256 in the verdict updates report.

• Information about File Analysis, including analysis results and whether or not a file was sent for analysis, are available only in the File Analysis report.

  Additional information about an analyzed file may be available from the cloud or on-premises File Analysis server. To view any available File Analysis information for a file, select Reporting Monitor > File Analysis and enter the SHA-256 to search for the file . If the File Analysis service has analyzed the file from any source, you can see the details. Results are displayed only for files that have been analyzed.

  If the appliance processed a subsequent instance of a file that was sent for analysis, those instances will appear in Message Tracking search results.

In logs:

• AMP and amp refer to the file reputation service or engine.
• Retrospective refers to verdict updates.
• VRT and sandboxing refer to the file analysis service.

Information about Advanced Malware Protection including File Analysis is logged in AMP Engine Logs.

File reputation filtering and analysis events are logged in AMP Engine logs and Mail logs.

In the log message “Response received for file reputation query” possible values for “upload action” are:

• 1: SEND. In this case, you must send the file for File Analysis.
• 2: DON’T SEND. In this case, you do not send the file for File Analysis.
• 3: SEND ONLY METADATA. In this case, you send only the metadata and not the entire file for File Analysis.
• 0: NO ACTION. In this case, no other action is required.

For “Disposition” in mail logs:

• 1: No malware detected or presumed clean (treated as clean)

• 2: Clean

• 3: Malware

Spyname is threat name.

Trace is not available for the file reputation filtering and analysis features. Instead, send a test message from an account outside your organization.

Problem

You receive several alerts about failures to connect to the file reputation or analysis services in the cloud. (A single alert may indicate only a transient issue.)

Solution

• Ensure that you have met the requirements in Requirements for Communication with File Reputation and Analysis Services.
• Check for network issues that may prevent the appliance from communicating with the cloud services.

• Increase the Query Timeout value:

  Select Security Services > File Reputation and Analysis. The Query Timeout value is in the Advanced settings area .

Problem

You receive an API key alert when attempting to view File Analysis report details, or the Email Security appliance is unable to connect to the AMP Threat Grid server to upload files for analysis.

Solution

This error can occur if you change the hostname of the AMP Threat Grid server and you are using a self-signed certificate from the AMP Threat Grid server, as well as possibly under other circumstances. To resolve the issue:

• Generate a new certificate from the AMP Threat Grid appliance that has the new hostname.
• Upload the new certificate to the Email Security appliance.
• Reset the API key on the AMP Threat Grid appliance. For instructions, see the online help on the AMP Threat Grid appliance.

Problem

Files are not evaluated or analyzed as expected. There is no alert or obvious error.

Solution

Consider the following:

• The file may have been sent for analysis by another appliance and thus already be present on the File Analysis server or in the cache of the appliance that is processing the file.

Problem

You receive alerts of severity Info about file types that can be sent for file analysis.

Solution

This alert is sent when supported file types change, or when the appliance checks to see what file types are supported. This can occur when:

• You or another administrator changes the file types selected for analysis.
• Supported file types change temporarily based on availability in the cloud service. In this case, support for the file types selected on the appliance will be restored as soon as possible. Both processes are dynamic and do not require any action from you.
• The appliance restarts, for example as part of an AsyncOS upgrade.