File Analysis Client ID on Content Security Appliances (ESA, SMA, WSA) and DC/FMC

Introduction

This document describes how to find or construct the 65 character File Analysis Client ID associated with Cisco Content Security Appliances, Email Security Appliance (ESA), Security Management Appliance (SMA), and Web Security Appliance (WSA), or from Cisco Defense Center (DC) or FirePower Management Center (FMC).

File Analysis Client ID on Content Security Appliances

ESA GUI

1. Security Services > File Reputation and Analysis
2. Click Edit Global Settings…
3. Expand Advanced Settings for File Analysis

The File Analysis Client ID is listed here.

vESA running AsyncOS 10.0.0-203 for Email Security example:

Note: There is a difference in the File Analysis Client ID for virtual appliance vs. hardware appliance.

The File Analysis Client ID is based on the following 65 character string format:

SMA GUI

1. Centralized Management > Security Appliances

In the bottom section, File Analysis, the File Analysis Client ID is listed here.

vSMA running AsyncOS 9.6.0-051 for Security Management example:

Note: There is a difference in the File Analysis Client ID for virtual appliance vs. hardware appliance.

The File Analysis Client ID is based on the following 65 character string format:

WSA GUI

1. Security Services > Anti-Malware and Reputation
2. Click Edit Global Settings…
3. In the Advanced Malware and Protection Services section, expand Advanced
4. Expand the Advanced Settings for File Analysis

The File Analysis Client ID is listed here.

WSA running AsyncOS 9.1.1-041 for Web Security example:

Note: There is a difference in the File Analysis Client ID for virtual appliance vs. hardware appliance.

The File Analysis Client ID is based on the following 65 character string format:

FMC/DC GUI

To get API Key (File Analysis ID) for FMC/DC, from the CLI run:

perl -MFlyLoader -e "print SF::Files::Analysis::get_apikey()"

Note: On some hardware there are multiple installations of Perl.  Running the default installation of Perl may not execute the command correctly.  If there are seen output errors, specify the following, direct path when calling Perl: /ngfw/usr/bin/perl -MFlyLoader -e "print SF::Files::Analysis::get_apikey()"

1. Navigate to AMP >Dynamic Analysis Connections
2. On the right side of the menu item panacea.threatgrid.com click on the Associate Icon.
3. A pop-up will appear, click Yes to complete the association.
4. Verify on the end of the URL the File Analysis Client ID. The ID begins after the devices%3D to the end of the URL.

 Example:

1.  Navigating Menu

 2. Associating the FMC 

3. Confirming Association

4. Verifying the File Analysis Client ID

Related Information

• Technical Support & Documentation - Cisco Systems
• Cisco Email Security Appliance - End-User Guides
• Cisco Web Security Appliance - End User Guides
• Cisco Security Management Appliance - End User Guides
• Cisco Firepower Management Console - End User Guides