AMP | How to block malware in sourcefire

[John]

one of our appliance (non-cisco) detect the malware. we would like to know how can we block the malware to sourcefice.

please see attached sample malware.

[David Janulik]

The basic answer would be, the AMP detects malware based on signature details.The machine learning called Spero engine detect abnomalies in the system and finally threatgrid as dynamic analysis with power of API automatic sample submissions.

David

[John]

how do we determine if the sourcefire already block the malware?

[David Janulik]

in the dashboard > Analysis > events > Threat detected

This is displayed as day/week/All

To search up for particular malware, you need to know its SHA. Than you can use the filter under Analysis > Search.

David