topic Script protection in Cisco AMP for Endpoints in Endpoint Security

Script protection in Cisco AMP for Endpoints

pavankumar.kakarla — Wed, 22 Jul 2020 17:18:16 GMT

I have enabled Script protection feature in our environment. Where do i verify if it is enabled or not in "Policy.XML" file. Can some one help with what is the keyword to check if this feature is enabled or not on a specific machine.

Re: Script protection in Cisco AMP for Endpoints

UMontero — Wed, 22 Jul 2020 17:36:02 GMT

Hello,

In order to check if you have Script Protection enabled on the Policy, please refer to the AMSI portion of it.

You might have something like this

<amsi>
<enable>1</enable> - Tells you if it's enabled or not
<mode>2</mode> Tells you if it's set to Quarantine or Audit
</amsi>