topic Block List Data Source in Cisco AMP in Endpoint Security

Block List Data Source in Cisco AMP

pavankumar.kakarla — Thu, 30 Apr 2020 13:39:11 GMT

What is the source that Cisco is referring to block the IP address under "Network" tab, Where can we find the source for this so that we can customize if required.

Re: Block List Data Source in Cisco AMP

Matthew Franks — Thu, 30 Apr 2020 14:21:29 GMT

AMP uses a subset of the TALOS Intelligence IP Blacklist. To create your own list, you can go to Outbreak Control > IP Block & Allow Lists. Once your list is created, go to edit your policy and add it in the Outbreak Control section.

Under Advanced Settings > Network, you can choose to use Cisco's list, Cisco and Custom, or just your Custom lists.

Thanks,

Matt

Re: Block List Data Source in Cisco AMP

pavankumar.kakarla — Thu, 30 Apr 2020 14:28:27 GMT

Thanks Matthew, So is this list dynamically updated by Cisco based on new threats. Is my understanding right?

Re: Block List Data Source in Cisco AMP

Matthew Franks — Thu, 30 Apr 2020 15:04:45 GMT

That is correct. The list is regularly updated by TALOS.

Thanks,

Matt