File Size is Too Small

[rick11]

Hello,

I see in our SIEM thousand of events called "File Size is Too Small" but they don't seems related to a signature but to a specific URL visited with a js link.

Do you have experienced something similar?

Thank you!

R

[mikael.lahtela]

Hi,

You are probably hitting a limit in advanced settings in Access Policy there is a setting called "Minimum file size for dynamic analysis testing" under Files and Malware Settings.
The default value is 15360 bytes, so it means that FMC is not sending smaller files for dynamic analysis.

br, Micke

[rick11]

Hello Micke , thank you. I'm a bit surprised because we don't have AMP enabled (no license)

I would like to avoid those alerts or the IPS to scan those files, what is suggested to do?

[mikael.lahtela]

In that case I would suggest you to open case with Cisco TAC.

br, Micke