AMP : disposition "malicious" allowed

[DBeiner]

Hello community,

My Meraki Security Dashboard inform me that a malware was downloaded on my network.

I can't find any informations about this file. Can you please tell me more ? And why a malicious file was allowed by my MX device ?

Thank you for your help and best regards,

David

[Shigella]

Interesting.  Under your IDS settings, are you set for Prevention or just Detection?

I have the same alerts, but mine are showing as Blocked.

[DBeiner]

After performing several tests, this problem occurs when updating MS Office.

Apparently Meraki's AMP service identifies files as malicious (false positive) :

[Brash]

Meraki is aware of the issue and are investigating.

It's believed to be a false positive caused by an O365 update.

https://community.meraki.com/t5/Security-SD-WAN/Advanced-Malware-Protection-AMP-retrospect-alert/m-p...

[DBeiner · Accepted solution]

Please follow this topic : Advanced Malware Protection (AMP) retrospect alert - The Meraki Community