What happens to the file while dynamic analyis is being performed?

[muthumohan]

In FTD, while the file is being analyzed in the sandbox by ThreatGrid, when happens to file in transit?

Please let me know if this is correct:

If the file policy rule action is "Malware Cloud Lookup", I believe the file is sent to the end user and a malware event will be generated once the threat-score comes from TG and the file is determined to be a malware.

My real question is, if the file policy rule action is "Malware Block", what does the end user see, while the file is being analyzed by Threatgrid? Does he get 99% of the file and wait for the last 1% till TG sends back the threat-score?

I believe TG can take more than 15 minutes to complete the analysis. Does this mean the client will have to hold the TCP connection, say FTP, open till the threat-score comes back from TG? What is the deal here?

Thanks and appreciate any help. No where in Cisco documentation explain this part.

Thanks

[nspasov · Accepted solution]

Block Malware will only occur if the file disposition of the SHA256 (From local cache or AMP) is malicious. If the file is unknown then it will be send to ThreatGrid for analysis. While the analysis is taking place, the file is allowed through the firewall and is not held "hostage" If analysis determines that the unknown file is malicious, then a retrospective event will be triggered for this file. 

I hope this helps!

Thank you for rating helpful posts!

[muthumohan · Accepted solution]

Thank you for your reply. I was thinking the same, but could not confirm as no Cisco document clearly says this.

Appreciate it.

[nspasov]

My pleasure! I have submitted an enhancement with the documentation team to update our documentation. Now, if you your question has been answered, please mark the thread as resolved