Cisco
Login
Search
Software Secure Firewall Threat Defense
Platform Secure Firewall Threat Defense Virtual
Activity Onboard

Network Malware Protection and File Policies Network Malware Protection and File Policies File Policies and File Rules File Rules File Rule Actions Malware Protection Options (in File Rule Actions) Local Malware Analysis Cached Disposition Longevity

Last updated: Jul 29, 2025

Cached Disposition Longevity

Dispositions returned from an AMP cloud query, associated threat scores, and dispositions assigned by local malware analysis, have a time-to-live (TTL) value. After a disposition has been held for the duration specified in the TTL value without update, the system purges the cached information. Dispositions and associated threat scores have the following TTL values:

  • Clean — 4 hours

  • Unknown — 1 hour

  • Malware — 1 hour

If a query against the cache identifies a cached disposition that timed out, the system re-queries the local malware analysis database and the AMP cloud for a new disposition.

Previous topic Local Malware Analysis Next topic Dynamic Analysis