In reply to Bcesar.

Hi Bcesar, that is the beauty of a layer security architecture such as AMP Everywhere. Imagine if a malicious file was transferred onto an endpoint via an external storage media or while it was offnet (from the MX). AMP for Endpoints will detect it and if configured to, quarantine it. More importantly, that file identified by it's file hash will now be known malicious to all security control points in the AMP Everywhere architecture; including the MX. Subsequent traversals of the file via network devices, such as the MX, will be blocked. See malicious once... block everywhere. The architecture can help contain the spread of malware to limit the scope of remediation. More information on AMP Everywhere can be found at: http://www.cisco.com/go/amp