cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3257
Views
0
Helpful
3
Replies

AMP File Analysis service (ThreatGrid Cloud)

Pravar
Level 1
Level 1

Hi, We are using ESA along with AMP File Reputation and File Analysis with ThreatGrid Cloud for incoming mails only. We noticed that the bounce back - "Undeliverable" emails with attachments are also scanned by AMP. Is it really required and normal behaviour? and  We are getting the following error message.

  " The attachment could not be uploaded to the File Analysis server because the appliance exceeded the upload limit" 

 

Understand that number of file sent for analysis by an appliance from ESA. How do we check the number of files sent by an appliance for analysis in 24 hours exactly?

Thanks in advance,

 

3 Replies 3

Libin Varghese
Cisco Employee
Cisco Employee

Hi,

 

AMP would attempt to scan all emails even NDR's. However you can certainly bypass AMP check based on your requirement.

 

You can review the approximate number of files uploaded for analysis using the AMP logs from the CLI.

grep "Dec 20.*File uploaded for analysis" amp -c
grep "Dec 21.*File uploaded for analysis" amp -c
etc

 

You can also review the AMP reports available under the Monitor tab.

 

Regards

Libin Varghese

Thanks Libin. This is really handy. However we are still receiving the alert message though the appliance shows very less compared to the limit of 500 for the C670 appliance.

You may want to open a TAC case to get that checked if the number of files uploaded is fairly less and the upload limit is still being reached.

 

TAC would probably need a remote access to the appliance to review the backend AMP logs.

 

Regards,

Libin Varghese

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: