https://community.cisco.com/t5/endpoint-security/amp-behavior-while-offline/m-p/4422990#M6180 <P><span class="lia-unicode-emoji" title=":envelope:">✉️</span> Hi team</P><P>How does AMP Endpoint behaves while being offline?</P><P>Is there a guide somewhere to explain how AMP protects systems while offline?</P><P>Thanks&nbsp;</P><H3><span class="lia-unicode-emoji" title=":woman_dancing:">💃</span></H3><P>&nbsp;</P><P>&nbsp;</P> Thu, 24 Jun 2021 06:53:52 GMT venianakis 2021-06-24T06:53:52Z https://community.cisco.com/t5/endpoint-security/amp-behavior-while-offline/m-p/4422990#M6180 <P><span class="lia-unicode-emoji" title=":envelope:">✉️</span> Hi team</P><P>How does AMP Endpoint behaves while being offline?</P><P>Is there a guide somewhere to explain how AMP protects systems while offline?</P><P>Thanks&nbsp;</P><H3><span class="lia-unicode-emoji" title=":woman_dancing:">💃</span></H3><P>&nbsp;</P><P>&nbsp;</P> Thu, 24 Jun 2021 06:53:52 GMT https://community.cisco.com/t5/endpoint-security/amp-behavior-while-offline/m-p/4422990#M6180 venianakis 2021-06-24T06:53:52Z https://community.cisco.com/t5/endpoint-security/amp-behavior-while-offline/m-p/4426261#M6192 <P>Hello&nbsp;<a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/450763">@venianakis</a>,<BR />the connector includes engines which are working online, and other which are also working offline. Enclosed some infos which may clarify your question. Offline outlines which engines are working withou any need to be connected to the Backend. Cloud IOCs are working online and offline, as the backend engine processes all the telemetry data 7 days back.<BR />BTW, have seen a small issue about exPrev in the screenshot, as the engine triggers under several conditions.</P> <DIV id="tinyMceEditor_6550a5c99ca3cdTroja007_0" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Engines_Part1.png" style="width: 999px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/124073iFF669BE69342C64C/image-size/large?v=v2&amp;px=999" role="button" title="Engines_Part1.png" alt="Engines_Part1.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Engines_Part3.png" style="width: 999px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/124072i49A0341ECEC45B0E/image-size/large?v=v2&amp;px=999" role="button" title="Engines_Part3.png" alt="Engines_Part3.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Engines_Part4.png" style="width: 999px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/124074iAA278B29AB74DED8/image-size/large?v=v2&amp;px=999" role="button" title="Engines_Part4.png" alt="Engines_Part4.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Engines_Part2.png" style="width: 999px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/124075i18C3A1AD7A922D76/image-size/large?v=v2&amp;px=999" role="button" title="Engines_Part2.png" alt="Engines_Part2.png" /></span></P> <P>Greetings,<BR />Thorsten</P> Wed, 30 Jun 2021 17:09:08 GMT https://community.cisco.com/t5/endpoint-security/amp-behavior-while-offline/m-p/4426261#M6192 Troja007 2021-06-30T17:09:08Z