cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
2955
Views
0
Helpful
4
Replies
kelvin.rk
Beginner

AMP for End Point - File Types That are Scanned by FireAMP Connector

Hello,

I have question for AMP for Endpoint, 

I am referring to documentation "File Types That are Scanned by FireAMP Connector"

http://www.cisco.com/c/en/us/support/docs/security/advanced-malware-protection-endpoints/118711-technote-fireamp-00.html

The Windows and Mac Connectors

Supported File Types Looked Up Against the Cloud

Device Trajectory and File Trajectory display these file types:

  • MSEXE
  • PDF
  • MSCAB
  • MSOLE2
  • ZIP
  • ELF
  • MACHO
  • MACHO_UNIBIN
  • SWF
  • JAVA

Unsupported File Type

  • Mac connector is able to scan everything but SWF.
  • Windows connector currently does not scan Elf, Java, xar(pkg), macho, or macho_unibin.

The Android Connector

  • Android connector examines APK files. 

May I know from the documentation:

1. Is it mean only those file type are supported to be scanned by FireAMP connector?

2. And I am referring to Firepower 6.0 config guide and found the following mention AMP for Endpoints support all file types:

http://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reference_a_wrapper_Chapter_topic_here.html#ID-2193-00000329

Table 2 Network vs Endpoint-Based Advanced Malware Protection Strategies

Feature

AMP for Firepower

AMP for Endpoints

file type detection and blocking method (file control)

in network traffic, using access control and file policies

not supported

malware detection and blocking method

in network traffic, using access control and file policies

on individual endpoints, using a connector that communicates with the AMP cloud

network traffic inspected

traffic passing through a managed device

none; connectors installed on endpoints directly inspect files

malware detection robustness

limited file types

all file types

3. And I can't find what is file referring to MACHO and MACHO_UNBIN, could please help advise what are file type in those category?

Thanks again for the help.

Thanks

Regards,

Kelvin

1 ACCEPTED SOLUTION

Accepted Solutions
Matthew Franks
Cisco Employee

Kelvin,

The file types you listed are the ones that are supported to show Device Trajectory and File Trajectory.  The other file types are still scanned and checked against the cloud, they're just not going to show on the Device and File Trajectory.  

For additional information on MACHO files, please refer to this article.

Thanks,

Matthew Franks

ENGINEER, CUSTOMER SUPPORT

FireAMP TAC

View solution in original post

4 REPLIES 4
Matthew Franks
Cisco Employee

Kelvin,

The file types you listed are the ones that are supported to show Device Trajectory and File Trajectory.  The other file types are still scanned and checked against the cloud, they're just not going to show on the Device and File Trajectory.  

For additional information on MACHO files, please refer to this article.

Thanks,

Matthew Franks

ENGINEER, CUSTOMER SUPPORT

FireAMP TAC

View solution in original post

Hi Matthew,

Thanks for clearing my doubt and thanks for the link. Excellent.

Thanks

Regards,

Kelvin

Matthew Franks
Cisco Employee

Kelvin,

I'd like to clarify a bit on the "other file types are still scanned" portion of what I said as I was mistaken.  All file types are reviewed and if the TETRA engine is enabled, then they are scanned by that engine, not necessarily checked against the cloud.  

Hi Matthew,

Thanks for the update, so without TETRA engine enabled, only the following are scanned and checked against the cloud?

Supported File Types Looked Up Against the Cloud

Device Trajectory and File Trajectory display these file types:

  • MSEXE
  • PDF
  • MSCAB
  • MSOLE2
  • ZIP
  • ELF
  • MACHO
  • MACHO_UNIBIN
  • SWF
  • JAVA

Unsupported File Type
•Mac connector is able to scan everything but SWF.
•Windows connector currently does not scan Elf, Java, xar(pkg), macho, or macho_unibin.

(As per the following document:

http://www.cisco.com/c/en/us/support/docs/security/advanced-malware-protection-endpoints/118711-technote-fireamp-00.html#anc2)

Thanks

Regards,

Kelvin

Create
Recognize Your Peers
Content for Community-Ad