Block malware only using Local Malware Analysis

vaibhav.parlekar1 — Fri, 21 Feb 2020 14:50:19 GMT

Hi,

As per the documentation FireAMP blocks malware based on known hash and Firepower and can hold the file for 30 secs to get the verdict. In case if the verdict is unknown by FireAMP then can we use the ClamAV engine which is part of local malware analysis to block the malware inline on the network. Or is the file already sent in the network post FireAMP lookup.

We are trying to reduce the no. of unknown files in the network and block them at the network level. I see the block malware option in the file-blocking policy with local malware analysis option. Just wanted to confirm before enabling the check.

Any help on the same is appreciated.

Vaibhav

Re: Block malware only using Local Malware Analysis

vaibhav.parlekar1 — Thu, 30 Nov 2017 00:24:17 GMT

has anyone tried blocking malware just with local malware analysis enabled in the file policy.

Vaibhav

topic Re: Block malware only using Local Malware Analysis in Network Security

Block malware only using Local Malware Analysis

Re: Block malware only using Local Malware Analysis