Nsp analysis feature in advanced malware policy

[Hiep_Nguyen]

• Hi everyone. 
• i'm testing the nsp analysis feature in the advanced malware policy but it doesn't seem to work. can anyone give me a sample pdf file to test this feature. sensor detects pdf file but no alert because the file is medium confident

[fkazi04]

Hello @Hiep_Nguyen 

You can add hash of the pdf file in blacklist and then download the same file. The sensor should be able to block the file download. Regarding alert generation, you can change severity to medium and check if the alerts are triggered.

[Hiep_Nguyen]

you know, i tried with hash file and blacklisted it but it didn't work. Even I have downloaded it over and over again and the result is the same. 

[fkazi04 · Accepted solution]

Hello @Hiep_Nguyen 

If your traffic is passing via proxy, there are chances the proxy is sending a cached copy. In such scenario, you can clear cache and check. If it's direct internet, kindly clear browser cache and Sensor malware cache using command clearmalwarecache

Kindly contact support team if the files are still getting downloaded.