File reputation filtering and the cloud

[Michael Eriksson]

Hi,

If I turn on file reputation filtering on the ESA but skip the File analysis part, what kind of data is then going to the cloud, if any? Just the hash of the file or what? I've tried to find some official document clarifying this in detail but haven't found any. I've just found high level descriptions and configuration how to's.

I would like to turn at least file reputation filtering on, but I have to present it and explain in detail what data is exchanged or sent to the cloud before that to guys in our security department. Then, if they say yes I can hopefully turn it on.

Grateful for any help.

Micke

[balaji.bandi]

here is explained example :

https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_010000.html

[Michael Eriksson]

Hi,

Thanx for your answer. I have read that one, but it's quiet "high flying" I think and there is no clear distinction between File Reputation Filtering and File Analysis. It also takes for granted you should use them both. I would like to know a bit more detail primarily about File Reputation Filtering since I don't think they will allow sending files to the cloud.

Thank you all the same.

Regards

Micke

[Ken Stieers · Accepted solution]

Yes, for File Reputation just the SHA256 of files are looked up against the cloud data.
File Analysis sends the files its unsure of for them to be executed in the ThreatGrid cloud and the results sent back. If you do this you can get a free "Device Management" ThreatGrid account so you can see what's going on there.
There is an ON-PREM ThreatGrid box available if that's a thing you might want...