Cisco Advanced Malware Protection (AMP)
When File Inspection is enabled, Secure Access uses AMP to scan for malicious files.
AMP is built on an extensive collection of real-time threat intelligence and dynamic malware analytics supplied by the Talos Security Intelligence and Research Group, and Secure Malware Analytics intelligence feeds. The Cisco AMP engine does not do real-time sandboxing, instead, the Cisco AMP integration blocks files with a known bad reputation based on the checksum or hash of the file. The AMP checksum database is comprised of lookup and data from all AMP customers and is a dynamic global community resource shared between customers utilizing the technology.
For more information about AMP, see Advanced Malware Protection (AMP).
AMP File limitations
AMP can compute the hash of an archive file but cannot compute the hashes of files contained by archive files.