AMP Cloud Lookup

For files that are eligible for assessment using Advanced Malware Protection, the management center performs a malware cloud lookup, querying the AMP cloud for the file's disposition based on its SHA-256 hash value.

To improve performance, the system caches dispositions returned by the cloud and uses the cached disposition for known files rather than querying the AMP cloud. For more information about this cache, see Cached Disposition Longevity.