topic how to control endpoint AMP devices? in Endpoint Security https://community.cisco.com/t5/endpoint-security/how-to-control-endpoint-amp-devices/m-p/3540308#M2328 <HTML><HEAD></HEAD><BODY><P>How to push the custom malicious file block policy to 5000 internal endpoint AMP devices?</P></BODY></HTML> Fri, 21 Feb 2020 05:00:22 GMT james.song1 2020-02-21T05:00:22Z how to control endpoint AMP devices? https://community.cisco.com/t5/endpoint-security/how-to-control-endpoint-amp-devices/m-p/3540308#M2328 <HTML><HEAD></HEAD><BODY><P>How to push the custom malicious file block policy to 5000 internal endpoint AMP devices?</P></BODY></HTML> Fri, 21 Feb 2020 05:00:22 GMT https://community.cisco.com/t5/endpoint-security/how-to-control-endpoint-amp-devices/m-p/3540308#M2328 james.song1 2020-02-21T05:00:22Z Re: how to control endpoint AMP devices? https://community.cisco.com/t5/endpoint-security/how-to-control-endpoint-amp-devices/m-p/3540309#M2329 <HTML><HEAD></HEAD><BODY><P>Hi James,</P><P></P><P>To apply a custom list of files to be blacklisted, you can add the SHA-256 hashes of the files into a simple custom detection list and have that list applied to one or more groups of your internal endpoint AMP devices.&nbsp; You can also create lists for Application (execution) Blocking.&nbsp; Cisco AMP for Endpoints has a Retrospective Security capability that has Cisco AMP for Endpoints polling the AMP Cloud for what we call a retrospective queue at configurable periodic intervals and will automatically pick these up and retrospectively quarantine blacklist files previously or now seen on the endpoint.&nbsp; As blacklisted applications are executed, they are now blocked.&nbsp; During outbreak control situations, do take into consideration caching of file dispositions on the endpoints and if caches needs to be flushed for your operations.</P><P></P><P>Details can be found in "Outbreak Control" Chapter 3 of the AMP for Endpoints (FireAMP) User Guide:</P><P><A href="https://immunet-janus-helpdoc.s3.amazonaws.com/FireAMPUserGuide.pdf" title="https://immunet-janus-helpdoc.s3.amazonaws.com/FireAMPUserGuide.pdf">https://immunet-janus-helpdoc.s3.amazonaws.com/FireAMPUserGuide.pdf</A></P><P></P><P></P><P>thanks and best regards,</P><P>Shyue Hong</P></BODY></HTML> Thu, 19 Nov 2015 02:12:44 GMT https://community.cisco.com/t5/endpoint-security/how-to-control-endpoint-amp-devices/m-p/3540309#M2329 schuang 2015-11-19T02:12:44Z