topic Re: File Size is Too Small in Network Security

File Size is Too Small

rick11 — Fri, 21 Feb 2020 15:09:27 GMT

Hello,

I see in our SIEM thousand of events called "File Size is Too Small" but they don't seems related to a signature but to a specific URL visited with a js link.

Do you have experienced something similar?

Thank you!

Re: File Size is Too Small

mikael.lahtela — Fri, 19 Jan 2018 18:05:28 GMT

Hi,

You are probably hitting a limit in advanced settings in Access Policy there is a setting called "Minimum file size for dynamic analysis testing" under Files and Malware Settings.
The default value is 15360 bytes, so it means that FMC is not sending smaller files for dynamic analysis.

br, Micke

Re: File Size is Too Small

rick11 — Tue, 13 Feb 2018 14:55:33 GMT

Hello Micke , thank you. I'm a bit surprised because we don't have AMP enabled (no license)

I would like to avoid those alerts or the IPS to scan those files, what is suggested to do?

Re: File Size is Too Small

mikael.lahtela — Wed, 14 Feb 2018 10:30:36 GMT

In that case I would suggest you to open case with Cisco TAC.

br, Micke