Firepower Allow Rule for File Malware Detection?

[mabouchard]

It appears that I am not able to select Intrusion or File Policy in a rule unless the rule is an "Allow Rule" rule. It seems like the "Allow" means allow it to firepower for Analysis. Is that correct? If so does this mean that the Intrusion and File Rules will be applied within the allow rule and then be blocked based on the action chosen within the file rule? 

I am asking as I am not feeling comfortable that I am blocking malware files. I have not found a good site to test this. Fortinet has a site but if I run their run of tests the only one that passes is the .txt file. Any kind of compressed or zip file fails. Does anyone have a good website to test for Malware I can see it being detected and blocked in the event logs?

Thanks

[yogdhanu]

Hi There,

Yes, you are right about the behavior. Only allow rules can have intrusion or file policy.

The logic here is If the rule action is block, than there is no point wasting resources for intrusion or file inspection as the traffic is being dropped anyways.

A popular way of testing malware is with http://www.eicar.org/ They provide sample malwares which you can use to test malware.

If you need to block malware inside of zip file, inspect archive under advance section of file policy needs to be enabled.

Thanks

Yogesh

Rate if it helps.