Malware Defense Licenses

A Malware defense license lets you perform Malware Defense and Secure Malware Analytics. With this feature, you can use devices to detect and block malware in files transmitted over your network.

To support this feature license, you can purchase the Malware defense (AMP) service subscription as a stand-alone subscription or in combination with IPS (TM) or IPS and URL Filtering (TMC) subscriptions.

Note

  • IPS license is a prerequisite for a Malware defense license.

  • Managed devices with Malware defense licenses enabled periodically attempt to connect to the Secure Malware Analytics Cloud even if you have not configured dynamic analysis. Because of this, the device's Interface Traffic dashboard widget shows transmitted traffic; this is expected behavior.

Configure Malware Defense in a file policy, then associate the file policy with one or more access control rules. File policies detect users who upload or download specific file types over supported application protocols.

Malware Defense can inspect a restricted set of those file types for malware by using:

  • Local malware analysis

  • File preclassification

  • Dynamic and Spero analysis in the Secure Malware Analytics

For files submitted to the Secure Malware Analytics Cloud, you can view the network file trajectory to see the path that the file took through your network.

The Malware Defense license also lets you add specific files to a file list. When you enable the file list in a file policy, the system automatically allows or blocks those files when it detects them.

Note that a Malware defense license is required only if you deploy Malware Defense and Secure Malware Analytics. Without a Malware defense license, the Cloud-Delivered Firewall Management Center can receive Secure Endpoint malware events and indications of compromise (IOC) from the Secure Malware Analytics Cloud.

Refer to important information at License Requirements for File and Malware Policies in the Cisco Secure Firewall Management Center Device Configuration Guide.

Disabled license behavior

When you disable this license:

  • The system stops querying the Secure Malware Analytics Cloud, and also stops acknowledging retrospective events sent from the Secure Malware Analytics Cloud.

  • You cannot re-deploy existing access control policies if they include Malware Defense configurations.

  • For a very brief time after a Malware defense license is disabled, the system can use existing cached file dispositions. After the time window expires, the system assigns a disposition of Unavailable to those files.

License expiration behavior

If the license expires, your entitlement for the above capabilities ceases and the Cloud-Delivered Firewall Management Center moves to the out-of-compliance state.