The screenshot indicates that you had a "Retrospective" event. Since the file had already been allowed in the network, your firewall cannot go back and change that action after the fact. You do have the option of blocking files with unknown disposition when initailly detected or also attempting to perform dynamic analysis prior to allowing them past the firewall.
Here's some more information explaining what happened:
Retrospective Malware Events (AMP for Firepower)
For malware detected in network traffic, dispositions can change. For example, the AMP cloud can determine that a file that was previously thought to be clean is now identified as malware, or the reverse—that a malware-identified file is actually clean. When the disposition changes for a file you queried in the last week, the AMP cloud notifies the system. Then, two things happen:
-
The Firepower Management Center generates a new retrospective malware event.
This new retrospective malware event represents a disposition change for all files detected in the last week that have the same SHA-256 hash value. For that reason, these events contain limited information: the date and time the Firepower Management Center was notified of the disposition change, the new disposition, the SHA-256 hash value of the file, and the threat name. They do not contain IP addresses or other contextual information.
-
The Firepower Management Center changes the file disposition for previously detected files with the retrospective event’s associated SHA-256 hash value.
If a file’s disposition changes to Malware, the Firepower Management Center logs a new malware event to its database. Except for the new disposition, the information in this new malware event is identical to that in the file event generated when the file was initially detected.
If a file’s disposition changes to Clean, the Firepower Management Center does not delete the malware event. Instead, the event reflects the change in disposition. This means that files with clean dispositions can appear in the malware table, but only if they were originally thought to be malware. Files that were never identified as malware appear only in the files table.
Reference: http://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/fpmc-config-guide-v60_chapter_01110001.html
