cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

634
Views
0
Helpful
2
Replies
Highlighted
Beginner

FTD Local Malware Analysis verdict shared with FMC?

Sorry: I posted this message in the wrong thread. I tried to move it to Firepower or to delete it but I can't.  Sorry ISE people.

 

When a managed device performs Local Malware Analysis on a file, it caches the verdict for x hours. Example: if file is detected as Malware, disposition is changed from Unknown to Malware and the verdict is cached for 1hr by default.  If file is detected as Clean, disposition stays Unknown and the result is cached also for 1hr (according to User Guide v6.5: https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/file_policies_and_advanced_malware_protection.html

 

Question: 

Would the FTD share with the FMC the Local Malware Analysis result? The User Guide doesn't mention if the FMC would hear the verdict of from an analysis performed locally on a FTD, thus caching that information and having it in case other FTDs query about the same hash.

 

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Beginner

2 REPLIES 2
Highlighted
Beginner

Highlighted
Cisco Employee

Content for Community-Ad