An unknown executable with no existing reputation arrives as an email attachment. The SOC wants to see what it actually does when run: files dropped, registry changes, processes spawned and network connections attempted. Which Cisco solution is designed for this?

Cisco Secure Malware Analytics, formerly Threat Grid, performs dynamic analysis. A submitted sample is executed in an instrumented sandbox environment, and the platform records its behavior: files created or modified, registry changes, processes launched, injection attempts and network activity such as DNS queries and HTTP connections. The report presents behavioral indicators, network artifacts and a threat score, giving the SOC evidence about what the file does rather than relying on reputation, which an unknown file does not have. Investigate in Cisco Secure Access analyzes domains, IP addresses and related DNS intelligence; it does not execute files, and its risk score describes domains, not attachments. ISE posture checks whether endpoints meet requirements such as installed antimalware and patches; it never executes unknown files for analysis, and running an unknown file on a production endpoint is exactly what a sandbox avoids. Duo Trust Monitor surfaces anomalous authentication events and risky device activity in Duo; it does not inspect email attachments. Exam caveat: sandbox results depend on the environment; evasive malware can behave differently, so a clean run is not absolute proof of safety. Operational check: submit the sample, review the behavioral indicators and network artifacts, and feed any confirmed indicators into blocking controls such as a custom detection or destination list.