topic Hey Cath, in Endpoint Security

Submitting files for Dyn Analysis: from SFR module or could it be done by FMC?

cpaquet — Fri, 21 Feb 2020 05:01:46 GMT

By reading the FirePOWER documentation and by looking at Cisco Live slides (see uploaded slide), it seems that files are submitted for dynamic analysis by the ASA-SFR directly for dynamic analysis.

Could the files be submitted for dynamic analysis by FMC 6.0 instead of SFR?

Thanks,

Cath.

Hello Team,

Jetsy Mathew — Fri, 02 Sep 2016 07:22:29 GMT

Hello Team,

For dynamic analysis, files are never sent from FMC and thus its not possible to use it instead of SFR.

Rate and mark correct if the post helps you.

Regards

Jetsy

Hello Team,

Jetsy Mathew — Wed, 07 Sep 2016 05:49:05 GMT

Hello Team,

Is your queries clear ?

If so , please rate and mark correct if the post helps you.

Regards

Jetsy

Hey Cath,

majacob2 — Wed, 07 Sep 2016 19:40:37 GMT

Hey Cath,

Dynamic analysis capable files are sent by the sensor to the cloud for analysis. The sensor in your deployment is the SFR module on the ASA. The way that dynamic analysis is designed, the file is only sent from the SFR module. There is no configuration that allows you to send file from the FMC for dynamic analysis. The file is intercepted at the sensor (SFR Module), not the FMC, so we have to send the file from the sensor to be analyzed. I hope this addresses your question adequately. Have a nice day!

Regards,

Matt J

FireAMP Engineer @Cisco

Hey Cath,

majacob2 — Wed, 07 Sep 2016 19:42:56 GMT

Hey Cath,

Regards,

Matt J

FireAMP Engineer @Cisco

Hello Team,

Jetsy Mathew — Tue, 13 Sep 2016 13:52:03 GMT

Hello Team,

Is your queries are clear now ?

Regards

Jetsy

Re: Hey Cath,

TS-Networker — Mon, 25 Mar 2019 15:00:17 GMT

what if you are dealing with sensitive documents? would dynamic analysis upload those sensitive documents to the cloud for analysis?