firepower malware file block configuration

[tato386]

I have a Firepower running in an ASA which is identifying files as malware but the file is still downloaded and I find it on the local drive of the PC.  I have attached snippets of the logs and the file rule.  Am I missing anything?

Thanks,

Diego

[Marvin Rhoads]

Have you applied the file policy in the Access Control Policy that affect the PC's location/address?

Could the PC have received the file prior to the policy being in place or while connected outside the protected LAN?

[tato386]

The firepower access policy has been in effect for this location for several weeks and it is successfully blocking banned URL categories.  The firepower logged the IP address and the correct user of the PC.  The time, date and size of the file on the PC match the one in the firepower logs.  So as far as I can tell the answer to your questions are yes and yes.

[Marvin Rhoads]

As far as I can see you have everything setup as I would have.

I'd suggest opening a TAC case and having them review the setup in more detail.

[tato386]

10-4, will do.

Thanks