https://community.cisco.com/t5/network-security/amp-for-endpoints-unknown-detection/m-p/3742724#M901738 <P>We have had a detection on one of our customers network which is named UNKNOWN and has a SHA of all 0's, it has been quarantined and is creating tickets in the AMP inbox, but there is no way to tell what this is.</P> <P>&nbsp;</P> <P>Has anyone seen this before and is there any way of looking into this without a diagnostics file being obtained and sent to Cisco TAC?</P> <P>&nbsp;</P> <P>Thank you,</P> <P>&nbsp;</P> <P>Molly</P> Fri, 21 Feb 2020 16:27:13 GMT MollyRStone19931 2020-02-21T16:27:13Z https://community.cisco.com/t5/network-security/amp-for-endpoints-unknown-detection/m-p/3742724#M901738 <P>We have had a detection on one of our customers network which is named UNKNOWN and has a SHA of all 0's, it has been quarantined and is creating tickets in the AMP inbox, but there is no way to tell what this is.</P> <P>&nbsp;</P> <P>Has anyone seen this before and is there any way of looking into this without a diagnostics file being obtained and sent to Cisco TAC?</P> <P>&nbsp;</P> <P>Thank you,</P> <P>&nbsp;</P> <P>Molly</P> Fri, 21 Feb 2020 16:27:13 GMT https://community.cisco.com/t5/network-security/amp-for-endpoints-unknown-detection/m-p/3742724#M901738 MollyRStone19931 2020-02-21T16:27:13Z