Cisco AMP Disposition

[tobbyf]

Hi everyone,

Cisco AMP found different malicious files, I saw 2 different dispositions on Cisco AMP:

Disposition: Malicious

Disposition: Blocklisted

Both files quarantined but can someone explain what is the difference between blocklisted and malicious disposition ?

Thanks

[Troja007]

Hello @tobbyf ,
I assume someone added the SHA256 to an Application Blocklist?

• Disposition Malicous: comes from a Cisco Source. You can review the Device Trajectory for Details which engine finally detected or if it was a cloud detection.
• Blocklisted: Indicates that the File has been added to a blocklist.

Greetings, Thorsten

[tobbyf]

Yes, thank you very much. Also I have one more question.

"For malware detected in network traffic, dispositions can change. For example, the AMP cloud can determine that a file that was previously thought to be clean is now identified as malware, or the reverse—that a malware-identified file is actually clean."

I can only see current disposition of the file on SIEM. If a file's disposition is clean now, should I consider it has no risk or it is still risky because maybe it has been "malware" in the past?

[Troja007 · Accepted solution]

Hello @tobbyf ,
when reviewing detection information using the SecureX Pivot Menu, the Ribbon or Threat Response, you always see the dates when a disposition was set and, if applicable, how long this disposition will be active.
Your question cannot be answered in a single statement.

• If a file is malicious, it will always be malicious.
• If there is an IP shown malicious, this IP might not be malicious in the future.
• The Cisco Security Architecture is generating relations between artifacts, observables and behaviour. This is something we outline we this decision has been made. 
• So finally different Cisco Intelligences might have different information about an observable.

Greetings, Thorsten

[tobbyf]

Thank you so much @Troja007