cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
403
Views
5
Helpful
3
Replies
Beginner

File Size is Too Small

Hello,

I see in our SIEM thousand of events called "File Size is Too Small" but they don't seems related to a signature but to a specific URL visited with a js link.

 

Do you have experienced something similar?

 

Thank you!

R

3 REPLIES
Enthusiast

Re: File Size is Too Small

Hi,

You are probably hitting a limit in advanced settings in Access Policy there is a setting called "Minimum file size for dynamic analysis testing" under Files and Malware Settings.
The default value is 15360 bytes, so it means that FMC is not sending smaller files for dynamic analysis.

br, Micke
Highlighted
Beginner

Re: File Size is Too Small

Hello Micke , thank you. I'm a bit surprised because we don't have AMP enabled (no license)

 

I would like to avoid those alerts or the IPS to scan those files, what is suggested to do?

Enthusiast

Re: File Size is Too Small

In that case I would suggest you to open case with Cisco TAC.

br, Micke
CreatePlease to create content
Ask the Expert- Firepower configuration & troubleshooting