topic Re: FMC AMP for Network Status in Network Security

FMC AMP for Network Status

Zachary Ballard — Fri, 21 Feb 2020 17:52:05 GMT

I patched our FMC from 6.4.0.2 to 6.4.0.7. I am receiving a warning that states " Successfully connected to cloud, Number of files detected in traffic exceeds module threshold."

Is this something that will clear itself up in time? This warning was not present before patching.

Thanks!!

Re: FMC AMP for Network Status

Marvin Rhoads — Mon, 27 Jan 2020 17:51:48 GMT

The patch may have made something visible that was there all along.

The message is indicating that you have sent more than 200 files in a 24-hour period to AMP cloud for ThreatGrid analysis.

I usually see this when applying a file policy on east-west traffic (i.e. between users and file servers) where the policy indicates to send unknown files on for analysis.

Re: FMC AMP for Network Status

chamnan neang — Thu, 28 Nov 2024 04:44:58 GMT

Thanks Marvin for response on this. Did you have any reference about this?
Best regards,
Chamnan,

Re: FMC AMP for Network Status

Marvin Rhoads — Fri, 29 Nov 2024 02:48:26 GMT

@chamnan neang here are two references:

"Public cloud that processes eligible files that you send for dynamic analysis, and provides threat scores and dynamic analysis reports. Firepower supports 200 samples/day for Secure Malware Analytics analysis. "

Reference: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/740/management-center-device-config-74/network-malware-protection.html

"In the new ThreatGrid sample limits model, these limits are the number of samples devices can upload for File Analysis per organization. All integrated devices (WSA, ESA, CES, FMC, and so on) and AMP for Endpoints are collectively entitled to 200 samples daily, regardless of the number of devices.

Note: This counter is not reset daily; instead, it works as a 24-hour rollover period.

Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/215283-understand-the-error-upload-limit-reach.html#toc-hId-30642250