FMC AMP for Network Status

[Zachary Ballard]

I patched our FMC from 6.4.0.2 to 6.4.0.7. I am receiving a warning that states " Successfully connected to cloud, Number of files detected in traffic exceeds module threshold." 

Is this something that will clear itself up in time? This warning was not present before patching.

Thanks!!

[Marvin Rhoads · Accepted solution]

The patch may have made something visible that was there all along.

The message is indicating that you have sent more than 200 files in a 24-hour period to AMP cloud for ThreatGrid analysis. 

I usually see this when applying a file policy on east-west traffic (i.e. between users and file servers) where the policy indicates to send unknown files on for analysis.

[chamnan neang]

Thanks Marvin for response on this. Did you have any reference about this? 
Best regards, 
Chamnan, 

[Marvin Rhoads]

@chamnan neang here are two references:

"Public cloud that processes eligible files that you send for dynamic analysis, and provides threat scores and dynamic analysis reports. Firepower supports 200 samples/day for Secure Malware Analytics analysis. "

Reference: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/740/management-center-device-config-74/network-malware-protection.html

"In the new ThreatGrid sample limits model, these limits are the number of samples devices can upload for File Analysis per organization. All integrated devices (WSA, ESA, CES, FMC, and so on) and AMP for Endpoints are collectively entitled to 200 samples daily, regardless of the number of devices.

Note: This counter is not reset daily; instead, it works as a 24-hour rollover period. 

"

Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/215283-understand-the-error-upload-limit-reach.html#toc-hId-30642250