topic Re: Cisco AMP Disposition in Endpoint Security

Cisco AMP Disposition

tobbyf — Mon, 12 Dec 2022 12:51:48 GMT

Hi everyone,

Cisco AMP found different malicious files, I saw 2 different dispositions on Cisco AMP:

Disposition: Malicious

Disposition: Blocklisted

Both files quarantined but can someone explain what is the difference between blocklisted and malicious disposition ?

Thanks 🙂

Re: Cisco AMP Disposition

Troja007 — Mon, 12 Dec 2022 13:15:44 GMT

Hello @tobbyf ,
I assume someone added the SHA256 to an Application Blocklist?

Disposition Malicous: comes from a Cisco Source. You can review the Device Trajectory for Details which engine finally detected or if it was a cloud detection.
Blocklisted: Indicates that the File has been added to a blocklist.

Greetings, Thorsten

Re: Cisco AMP Disposition

tobbyf — Mon, 12 Dec 2022 13:27:10 GMT

Yes, thank you very much. Also I have one more question.

"For malware detected in network traffic, dispositions can change. For example, the AMP cloud can determine that a file that was previously thought to be clean is now identified as malware, or the reverse—that a malware-identified file is actually clean."

I can only see current disposition of the file on SIEM. If a file's disposition is clean now, should I consider it has no risk or it is still risky because maybe it has been "malware" in the past?

Re: Cisco AMP Disposition

Troja007 — Mon, 12 Dec 2022 14:07:04 GMT

Hello @tobbyf ,
when reviewing detection information using the SecureX Pivot Menu, the Ribbon or Threat Response, you always see the dates when a disposition was set and, if applicable, how long this disposition will be active.
Your question cannot be answered in a single statement. 🙂

If a file is malicious, it will always be malicious.
If there is an IP shown malicious, this IP might not be malicious in the future.
The Cisco Security Architecture is generating relations between artifacts, observables and behaviour. This is something we outline we this decision has been made.
So finally different Cisco Intelligences might have different information about an observable.

Greetings, Thorsten

Re: Cisco AMP Disposition

tobbyf — Mon, 12 Dec 2022 15:38:21 GMT

Thank you so much @Troja007