cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1581
Views
0
Helpful
1
Replies

archives not detected

apepacisco
Level 1
Level 1

Hi,

i'm testing  cisco firepower AMP,  it is correct that with a  "malware block" policy  in AMP  all tests   with ecrypted files fail ?

i using this site:

metal.fortiguard.com

it seems to block only plain, tar and cab files.

1 Reply 1

emirolyu
Cisco Employee
Cisco Employee

What do you mean by saying the tests for encrypted files fail?

If you're referring to downloading files through HTTPS, the contents may not be visible, unless you've configured the device to perform decryption. If you speak about encrypted archives, there's a policy (Advanced tab) action to block files, that cannot be inspected.

It's all documented in the config guide: Firepower Management Center Configuration Guide, Version 6.2 - File Policies and AMP for Firepower [Cisco Firepower Ma…

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: