A manufacturer's Secure Firewall Management Center is integrated with Cisco Secure Endpoint. A signed installer passed the file policy on Monday, and on Wednesday Secure Endpoint flagged the same file as malicious on one workstation. The SOC lead wants every host that already received that file. Which capability in FMC answers that request?
Select an answer to reveal the explanation.
Short Explanation
The retrospective alert tells you the file turned bad later, and file trajectory shows its observed path host by host. It's a parcel tracking history rather than a sick list. IP searches, agent detections and forward-looking blocks each leave out hosts you need.
Full Explanation
When Cisco Secure Endpoint is integrated with Secure Firewall Management Center, verdicts from the endpoint agent can come back as retrospective events, which describe a file that was allowed at the time and judged bad later. The matching file record supports trajectory, an ordered view of the hosts where FMC observed the file, when each observed transfer happened, and which connection carried it. This shows the file's observed spread, but does not guarantee a complete list of every host that received it. Searching connection events by the affected workstation's address fails the completeness requirement, because other recipients come from different addresses and may sit behind NAT. Opening the Secure Endpoint detections list fails the same requirement, since it only names hosts where an agent actually flagged the file, and any machine without an agent or without a detection stays off the list. A file policy rule that blocks the installer by name is forward-looking, so it stops future transfers but answers nothing about hosts that already received the file. Exam caveat: trajectory exists only if the file policy inspected that transfer in the first place. Practical check: pull the trajectory for the hash and compare the observed host list with download logs from the affected day.