Cisco AMP retroactive convictions from LOWRISK to MALICIOUS

[talbarado]

Receiving Cisco AMP retroactive convictions from LOWRISK to MALICIOUS, but the files are not available in AMP/ThreatGrid as a reviewable scanned file, such that the behaviors can be extracted and mitigation be implemented based on that data.

Current Workflow:

1. File passes through Ironport / AMP
2. Email with file is delivered
3. AMP retroactively convicts the file
4. Notification is sent to the team via alert from Ironport
5. Hash is available in the alert
6. Team searches for the hash in AMP/Threatgrid – not found
7. Team retrieves file from endpoint an runs through Threat Grid Sandbox manually. In both cases nothing malicious was found

Anyone have any experience with this? 

[Ken Stieers]

What was the threat name?

Look it up here: https://talosintelligence.com/amp-naming

Some threats arent necessarily malicious (*in05 for example)

[talbarado]

Thanks for the insight. Unfortunately this page does not have my particular event listed. It also does not list any IOCs of which we ultimately want to have to find out if there was any nefarious activity during the time of the rating change.