topic AMP for End Point - File Types That are Scanned by FireAMP Connector in Endpoint Security

AMP for End Point - File Types That are Scanned by FireAMP Connector

kelvin.rk — Fri, 21 Feb 2020 05:02:14 GMT

Hello,

I have question for AMP for Endpoint,

I am referring to documentation "File Types That are Scanned by FireAMP Connector"

http://www.cisco.com/c/en/us/support/docs/security/advanced-malware-protection-endpoints/118711-technote-fireamp-00.html

The Windows and Mac Connectors

Supported File Types Looked Up Against the Cloud

Device Trajectory and File Trajectory display these file types:

MSEXE
PDF
MSCAB
MSOLE2
ZIP
ELF
MACHO
MACHO_UNIBIN
SWF
JAVA

Unsupported File Type

Mac connector is able to scan everything but SWF.
Windows connector currently does not scan Elf, Java, xar(pkg), macho, or macho_unibin.

The Android Connector

Android connector examines APK files.

May I know from the documentation:

1. Is it mean only those file type are supported to be scanned by FireAMP connector?

2. And I am referring to Firepower 6.0 config guide and found the following mention AMP for Endpoints support all file types:

http://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reference_a_wrapper_Chapter_topic_here.html#ID-2193-00000329

Table 2 Network vs Endpoint-Based Advanced Malware Protection Strategies
Feature	AMP for Firepower	AMP for Endpoints
file type detection and blocking method (file control)	in network traffic, using access control and file policies	not supported
malware detection and blocking method	in network traffic, using access control and file policies	on individual endpoints, using a connector that communicates with the AMP cloud
network traffic inspected	traffic passing through a managed device	none; connectors installed on endpoints directly inspect files
malware detection robustness	limited file types	all file types

3. And I can't find what is file referring to MACHO and MACHO_UNBIN, could please help advise what are file type in those category?

Thanks again for the help.

Thanks

Regards,

Kelvin

Kelvin,

Matthew Franks — Wed, 05 Oct 2016 13:13:48 GMT

Kelvin,

The file types you listed are the ones that are supported to show Device Trajectory and File Trajectory. The other file types are still scanned and checked against the cloud, they're just not going to show on the Device and File Trajectory.

For additional information on MACHO files, please refer to this article.

Thanks,

Matthew Franks

ENGINEER, CUSTOMER SUPPORT

FireAMP TAC

Hi Matthew,

kelvin.rk — Thu, 06 Oct 2016 01:28:02 GMT

Hi Matthew,

Thanks for clearing my doubt and thanks for the link. Excellent.

Thanks

Regards,

Kelvin

Kelvin,

Matthew Franks — Mon, 17 Oct 2016 11:00:18 GMT

Kelvin,

I'd like to clarify a bit on the "other file types are still scanned" portion of what I said as I was mistaken. All file types are reviewed and if the TETRA engine is enabled, then they are scanned by that engine, not necessarily checked against the cloud.

Hi Matthew,

kelvin.rk — Sun, 23 Oct 2016 12:32:33 GMT

Hi Matthew,

Thanks for the update, so without TETRA engine enabled, only the following are scanned and checked against the cloud?

Supported File Types Looked Up Against the Cloud

Device Trajectory and File Trajectory display these file types:

MSEXE
PDF
MSCAB
MSOLE2
ZIP
ELF
MACHO
MACHO_UNIBIN
SWF
JAVA

Unsupported File Type
•Mac connector is able to scan everything but SWF.
•Windows connector currently does not scan Elf, Java, xar(pkg), macho, or macho_unibin.

(As per the following document:

http://www.cisco.com/c/en/us/support/docs/security/advanced-malware-protection-endpoints/118711-technote-fireamp-00.html#anc2)

Thanks

Regards,

Kelvin