topic Re: Does Cisco AMP for Endpoints support Netapp share in Endpoint Security

Does Cisco AMP for Endpoints support Netapp share

pavankumar.kakarla — Tue, 16 Jun 2020 18:16:59 GMT

Does cisco AMP for Endpoints support Netapp shares which is used for file sharing?

If not will Cisco AMP scans the Netapp file shares which are connected on windows servers?

Re: Does Cisco AMP for Endpoints support Netapp share

balaji.bandi — Tue, 16 Jun 2020 19:30:22 GMT

Monitor Network Drives allows you to set the Malicious Activity Protection engine to
detect malicious activity from the local computer affecting network drives. This setting
only applies to AMP for Endpoints Windows Connector version 6.3.1 and later.

here is endpoint user guide :

https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20User%20Guide.pdf

Re: Does Cisco AMP for Endpoints support Netapp share

pavankumar.kakarla — Tue, 16 Jun 2020 19:48:09 GMT

So we dont have any options to enable Normal scans for these network drives on the server.

@balaji.bandi wrote:
Monitor Network Drives allows you to set the Malicious Activity Protection engine to
detect malicious activity from the local computer affecting network drives. This setting
only applies to AMP for Endpoints Windows Connector version 6.3.1 and later.

here is endpoint user guide :

https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20User%20Guide.pdf

Re: Does Cisco AMP for Endpoints support Netapp share

Troja007 — Wed, 17 Jun 2020 10:49:12 GMT

Hello @pavankumar.kakarla,

yes, AMP for Endpoints does not provide an integration into NetApp vscan module. You can message me, so i can open a Feature Request for you.

Greetings,

Thorsten

Re: Does Cisco AMP for Endpoints support Netapp share

Jim2k — Wed, 17 Jun 2020 12:32:59 GMT

just an FYI there is a bug with cisco AMP and Netapp. With MAPP turned on the machine generates HIGH IOPS in the NetApp storage. it has something to do with offline file sync. even if the machine was idle the high IOPS would be generated. we were on version 6.1.7 agent. we just turned off MAPP and that fixed the issue. we also use another AV vendor on the desktop to deal with ransomware. i did try different exclusions and worked with cisco TAC on the issue. Turning off mapp was the answer

Re: Does Cisco AMP for Endpoints support Netapp share

Troja007 — Wed, 17 Jun 2020 13:34:15 GMT

Hello @Jim2k,

thanks for the info. Has this bug being confirmed by Cisco? Will have a closer look today. Do you have a BUG ID?

Thanks and Greetings,

Thorsten

Re: Does Cisco AMP for Endpoints support Netapp share

Jim2k — Wed, 17 Jun 2020 13:45:59 GMT

here is the link to the bug. It does not look like it is fixed

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvo32112

Re: Does Cisco AMP for Endpoints support Netapp share

Troja007 — Thu, 18 Jun 2020 07:33:51 GMT

Thanks for sharing the link. Dev has identified the cause of the issue, hopefully we get a fix soon. 🙂

Re: Does Cisco AMP for Endpoints support Netapp share

jesutorr@cisco.com — Mon, 22 Jun 2020 20:10:35 GMT

Hi,

Thanks for using Cisco Community, regarding your inquiry,

You can find more information about the exclusions in this Video: https://video.cisco.com/video/6038252112001

And in this article: https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215261-analyze-amp-diagnostic-bundle-for-high-c.html

I´m attaching you a master article for with very good information that can help https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215624-master-guide-for-amp-for-endpoints.html

Best Regards!

Re: Does Cisco AMP for Endpoints support Netapp share

p.costa — Fri, 11 Feb 2022 13:50:45 GMT

Hi @Troja007 ,

we have also a customer requesting this feature. Can you add us to the feature request?

Re: Does Cisco AMP for Endpoints support Netapp share

johnosn — Tue, 15 Feb 2022 16:18:56 GMT

You could investigate using a product from OPSWAT to integrate with Cisco Secure Endpoint. Using a product like MetaDefender ICAP Server in conjunction with NetApp would allow files to be scanned when written to storage, but it would still not allow a full scan of the entire storage platform.

Just a thought.

Re: Does Cisco AMP for Endpoints support Netapp share

Troja007 — Thu, 17 Feb 2022 07:52:51 GMT

Hello @p.costa ,
sure, just send me a private message with Company name and I can add you as a requester to the FR. Please add additional notes like a feature description.

Greetings,
Thorsten

Re: Does Cisco AMP for Endpoints support Netapp share

p.costa — Thu, 17 Feb 2022 09:54:01 GMT

Thanks @Troja007 , I have sent a PM 🙂