Firepower Block Reason Investigating

[georgehewittuk1]

Hi All,

Just trying to troublehsoot & wanted to question if a file is blocked in this case it's an email with an attachment (we suspect it is between exchange & ESA)  can we dig any deeper other than just seeing 'File Block' into what the attachment was/reasons etc?

We are using 6.6.4 & have malware policy enabled for the access-rule.

Also is there a way in whitelisting a file that maybe a false positive.

Thanks

G

[Marius Gunnerud]

You should be able to configure the file policy to capture and store the file.  Once the file is stored you will be able to download for further analysis.  View the file at Analysis > Files > Captured Files.

As for allowing false positives, you can add the file to a "clean list"