1. How can the FMC be configured so that managed devices will block files with cloud lookup disposition: Unavailable instead of letting the file go through while it's waiting for AMP Cloud connectivity to resume?
2. How does the firewall treat a file that has the file disposition result UNKNOWN but for which Dynamic Analysis has not be turned of? (no checkmark for dynamic analysis or spero or local malware analysis)
3 Is there a way to configure the File Policy to say "If AMP disposition is Unknown, block the file" (instead of uploading it to ThreatGrid (I realise that too many files would be dropped in this case, without having any Spero or Local Malware lookup performed).
Thanks.
