topic Re: AMP - Actions made after Require Attention option in Endpoint Security

AMP -

Juan Carlos Arias Perez — Fri, 21 Feb 2020 05:08:05 GMT

Hello, evaluating AMP for Endpoints first configuring policy to Audit, and after that first scan I change computers to group of Protect, check image attached, and my question is, how to apply the actions?? There are files detected that I delete it and still being reported by AMP.

On Requiere Attention I enabled, but it´s been more than 4 days with events In Progress but nothing does. How can I apply actions to take AMP?

Regards,

Juan Carlos Arias

Re: AMP -

Matthew Franks — Tue, 26 Feb 2019 00:05:42 GMT

Juan,

Those will not automatically be marked as Resolved. When there is an event in the Requires Attention section, you can click the Begin Work button which will move it into the In Progress section. Then, you can click Mark Resolved when you are finished. This is done manually by a user as a way to track tasks, not automatically by anything on AMP's side. I hope that clears things up for you!

Thanks,

Matt

Re: AMP - Actions made after Require Attention option

Juan Carlos Arias Perez — Tue, 26 Feb 2019 14:41:10 GMT

Hello Matthew, thanks for your comments, I made the steps you mention, but events remain In Progress tab until you select it and Mark Resolved, is this correct??

But, on events of this Computer, I can see that some events actions like Policy Update, Scan Clean, Scan Started, and I can see one that it says Executed Malware, what are the recommended actions for this event??

Regards,

Juan Carlos Arias

Re: AMP - Actions made after Require Attention option

Matthew Franks — Tue, 26 Feb 2019 16:03:57 GMT

Juan,

You are correct that they will remain In Progress until you mark them as Resolved. As for the Malware Executed, there are a number of reasons you may see this, most common being that the policy was in Audit mode. If you would like someone to take a closer look, I recommend opening a TAC case.

Thanks,

Matt

Re: AMP - Actions made after Require Attention option

Juan Carlos Arias Perez — Tue, 26 Feb 2019 22:06:58 GMT

Matthew, I´m evaluating the solution so I can´t open a case on TAC yet and my policy is to Protect. What I can see is that you need another software to complement the solution, like an AV or FW, is this correct?? I´m saying this based on the actions that can be made after detecting malware or virus or something else, just trying to understand, thanks.

Re: AMP - Actions made after Require Attention option

Matthew Franks — Tue, 26 Feb 2019 22:09:59 GMT

Juan,

If you are in a POV, you can ask your Account Manager to open a case on your behalf with the appropriate logs from the system. With Malware Executed events, what typically takes place is a malicious process attempted to execute and AMP quarantined it. Look for a Quarantine event at the same time for the same file.

Thanks,

Matt

Re: AMP - Actions made after Require Attention option

Juan Carlos Arias Perez — Tue, 26 Feb 2019 22:15:47 GMT

You´re right Matthew, some files have been moved to Quarantine, I didn´t notice that before.
Regards,