AMP file reputation HASH issue

[may-ye]

Will AMP File Analysis upload document attachments for inspection?

Because of the AMP File Reputation phase, only the HASH of the document are verified.But the hash value changes whenever the document content replaces only one character. In this case, will the result of file reputation be unknown and the file file be uploaded?

[Ken Stieers]

Before AMP uploads the file it does check to see if there is any code in the file... so a doc with macros would get uploaded but not docs with out code.

IIRC its the ClamAV engine that does this.

[may-ye]

If I change the contents of.doc, will the hash value calculated by File Reputation change?

[Ken Stieers]

Yes.

[may-ye · Accepted solution]

• If you have enabled the File Analysis service, and the reputation service has no information about the file, and the file meets the criteria for files that can be analyzed (see Supported Files for File Reputation and Analysis Services), then the message can be quarantined (see Quarantining Messages with Attachments Sent for Analysis) and the file sent for analysis. If you have not configured the appliance to quarantine messages when attachments are sent for analysis, or the file is not sent for analysis, then the message is released to the user.

https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-5/user_guide/b_ESA_Admin_Guide_12_5/b_ESA_Admin_Guide_12_1_chapter_010001.html#con_1809504