Tracks the spread of any file within your network and continuously monitors file reputation over time. If a file reputation changes to malicious or is found by file sandboxing to be malicious, AMP provides retrospective alerting in the after phase. AMP identifies every instance of the file within your network to address the problem of malicious files passing through perimeter defenses that are later deemed a threat.
https://www.cisco.com/c/en/us/td/docs/security/web_security/scancenter/administrator/guide/b_ ScanCenter_Administrator_Guide/b_ScanCenter_Administrator_Guide_chapter_011101.pdf