Retrospective events take place when there is a change in a prior event with firepower.
If the system learns that a files mail where a disposition has changed these are called retrospective
mail where events a file disposition is the status of a file after it has been analyzed by Cisco's cloud
database so files disposition could be unknown initially but later on as the cloud learns more about
the file it could determine that it was actually a bad file and trigger a retrospective event that would
consider the file malicious and block any future transfers for that file.
Now I'll hop into a fire power management center to show you where you can look at retrospective file
events.
So here I am in the fire power management center.
If you go to analysis files and network file trajectory it shows you files that have the disposition
of malware.
So just click on one of these files.
So for a retrospective event the trajectory would show that a file so the network was transferred between
hosts and at the beginning of the file trajectory history the file would actually show as known or clean.
And if the cloud determine that the file was malicious after the file was actually on the network it
would sign a retrospective event which would be shown by the symbol in the trajectory letting you know
that the file initially wasn't considered to be malicious but then was due to further analysis.