topic Re: What happens to the file while dynamic analyis is being performed? in Network Security

What happens to the file while dynamic analyis is being performed?

muthumohan — Tue, 07 Dec 2021 17:16:44 GMT

In FTD, while the file is being analyzed in the sandbox by ThreatGrid, when happens to file in transit?

Please let me know if this is correct:

If the file policy rule action is "Malware Cloud Lookup", I believe the file is sent to the end user and a malware event will be generated once the threat-score comes from TG and the file is determined to be a malware.

My real question is, if the file policy rule action is "Malware Block", what does the end user see, while the file is being analyzed by Threatgrid? Does he get 99% of the file and wait for the last 1% till TG sends back the threat-score?

I believe TG can take more than 15 minutes to complete the analysis. Does this mean the client will have to hold the TCP connection, say FTP, open till the threat-score comes back from TG? What is the deal here?

Thanks and appreciate any help. No where in Cisco documentation explain this part.

Thanks

Re: What happens to the file while dynamic analyis is being performed?

nspasov — Thu, 09 Dec 2021 16:58:10 GMT

Block Malware will only occur if the file disposition of the SHA256 (From local cache or AMP) is malicious. If the file is unknown then it will be send to ThreatGrid for analysis. While the analysis is taking place, the file is allowed through the firewall and is not held "hostage" If analysis determines that the unknown file is malicious, then a retrospective event will be triggered for this file.

I hope this helps!

Thank you for rating helpful posts!

Re: What happens to the file while dynamic analyis is being performed?

muthumohan — Sat, 25 Dec 2021 05:22:31 GMT

Thank you for your reply. I was thinking the same, but could not confirm as no Cisco document clearly says this.

Appreciate it.

Re: What happens to the file while dynamic analyis is being performed?

nspasov — Tue, 04 Jan 2022 19:44:22 GMT

My pleasure! I have submitted an enhancement with the documentation team to update our documentation. Now, if you your question has been answered, please mark the thread as resolved 🙂