formation cisco ccna 200-301

formation cisco ccna 200-301.To help identify malware and mitigate its impact, the FMC File Control, Network File Retention, and Advanced Malware Protection (AMP) features detect, track, crawl, analyze, log, and block (optionally) files in transit (including files with malware built into them and files embedded in archived files).Note: This system can also be merged with the AMP deployed by the unit for endpoints to import scan logs, malware detection logs, quarantine logs, and416 Chapter 11 Network and Host Insight TechnologiesIntrusion Indicators (IOCs).The FMC can log a variety of file and malware events. The information available for any individual event varies with how it was generated and why it was generated. Malware events present malware detected by AMPs for Firepower or AMPs for endpoints; in addition to being able to log threats provided by deployed AMPs for endpoints, malware events can also log other data, such as scans and quarantines. As an example, you can click Analysis->Files-> Malware->Events, to display all malware events, as shown in Figure 11-18.Figure 11-18 FMC Malware SummaryRetrospective malware events present files detected by AMP for which a change has been made to the disposition of the files. The network file retention feature creates a correspondence with the way hosts transfer files (including malware) within the network. The file retention feature records the data transferred through the file, the disposition of the file, and whether the file transfer was blocked or quarantined. Network administrators can determine which hosts transmitted malware and which hosts are at risk, and can also observe file transfer trends. The Network File Trajectory window, shown in Figure 11.19, shows the results of the detection of the malicious file win.trojan.wootbot-199 in Figure 11-18.11.2 Network Insight Techniques 417OnwOverview Analyns PoHciw Ot^ect* C O A 54.100.10.21^ ConUMt &wtor.r Conn.cUon$ , IntrutSf . RRrt . IWwork FiUr Tra}.ctory