amp / threat grid timeout on mail attachment analysis

[cos_nantes]

Hello,

I have a question about cisco amp and threat grid. Is it possible to block a mail when the file attachment analysis takes too long time, and then send a mail to alert about this analysis ?

Regards

[marc.luescherFRE]

You can extend the File Analysis release time from 30 Minutes to 120 Minutes.

We never had a single message taking more then 52 min. That way emails would only get released once AMP checks are completed.

[cos_nantes]

Thanks for your reply.

And can ask you where is this option ? I searched in threat grid and in file reputation and analysis settings in the email security appliance but i can't find any option about this time.

Regards

[marc.luescherFRE]

If you have a SMA , connect to your SMA and go into the policy virus and outbreak quarantine view.

if you have only ESA, then go into the same option on your ESA ( under security services ?)

Look for a quarantine called File Analysis

Click on the File Analysis quarantine name.

This should open the definition of the PVO and one option will be called retention period. Increase the retention period to the maximum values you wanted like 120 min. Submit and Commit and you should be all set.

From now on AMP will only release messages to end users when 120 min are expired and the AMP verdict was still not received. We have never seen such long wait times in production ever so you should be all set. It is more likely that you will get a corrupt document.

I hope that helps

-Marc

[cos_nantes]

I don't understand, the PVO Quarantines option isn't activated on our ESA or SMA. But we have the file analysis activated under AMP option on ESA wich is link with our threat grid server. So is the PVO option is required to set the timeout option ?

Thanks for your time.

Regards

[marc.luescherFRE]

Let me try to explain how AMP and File Analysis are tied together

AMP puts every email message in an internal PVO queue called "File Analysis" when a file which is classified by AMP preclassification as "needing to be uploaded" is being processed.

The file and the corresponding email will remain in this queue until one of the following is happening:

a) the verdict from ThreatGrid/AMP came back and the message can be released form File Analysis

b) the retention timeout period of the File Analysis Queue (default 30 Min) has expired and there was no verdict yet from ThreatGrid/AMP, so the email is released 

c) a retrospective alert, should MAR be enabled would at a later time still pull any bad messages from O365, should a malicious verdict come back after 30 Min.

I just checked our testsystem. Should you have centralized quarantines enabled the queue will be on your SMA, in the other case it will be on your ESA under Monitor/Policy, Virus and Outbreak Quarantines.

I hope this helps futher.

-Marc