Which action should you take when Cisco Threat Response notifies you that AMP has identified a file as malware?

Upon receiving a notification from Cisco Threat Response about malware identified by AMP, proactively adding the malicious file to a block list is essential. This action ensures that the file is prevented from executing, spreading, or being processed across the network and endpoints in the future, providing an explicit and enforced security measure beyond initial detection.

Sending a snapshot to Cisco for technical support is usually performed for troubleshooting system issues, not as a primary response to a malware detection.

Forwarding the investigation results to an external threat-analysis engine is unnecessary when Cisco AMP has already made a definitive malware identification.

While AMP often automatically blocks known malware, waiting passively is not the proactive action *you* should take when notified; manual intervention to add to a block list ensures broader and custom enforcement.