topic Re: Urls blocking using amp in Endpoint Security

Urls blocking using amp

sv7 — Wed, 01 Mar 2023 12:10:29 GMT

Hi All,

Is it possible to restrict or block any urls using amp ?. Like client wants to restrict windows update using amp install in user machine.

Please advise.

Re: Urls blocking using amp

pmedinac — Wed, 01 Mar 2023 13:57:22 GMT

Hi @sv7

Cisco Secure Endpoint (formerly AMP) cannot block some/any URLs since the solution is not a firewall, Will only bring capabilities to isolate a machine but the URLs cannot be blocked. I would recommend a firewall for that task since it is pure purpose.

~Pedro

Re: Urls blocking using amp

UMontero — Wed, 01 Mar 2023 17:31:20 GMT

Adding to what Pedro mentioned.

Indeed, CSE is not a firewall, so it does not provide URL blocking mechanism, but there is a feature in Cisco Secure Endpoint which works with IP/CIDR block ranges.

Possibly this feature can help you

Re: Urls blocking using amp

smjehanzeb — Wed, 31 May 2023 14:13:29 GMT

Since EDR shows Complete Employee/User Visibility so why we can't block URL at end-host, Why request make overhead on a network to block on Firewall.

Re: Urls blocking using amp

smjehanzeb — Wed, 31 May 2023 14:19:36 GMT

Cisco Endpoint is not a complete solution which block/Quarantine Malicious File Block Hash, IP URL and Domain.

It only Block Malicious File Hash, Quarantine File , Scan System and IP Allow and Block

What about web browser (Google Chrome/Firefox) malicious hits? Does it block malicious URL on end-Host

Re: Urls blocking using amp

Ken Stieers — Wed, 31 May 2023 14:31:28 GMT

URL blocking is NOT a feature of Cisco Secure Endpoint. It's just NOT there.
For URL blocking you need to either do it in something like Umbrella, Web Security Appliance or Firewall (assuming FTD or Palo Alto, or similar devices)

Re: Urls blocking using amp

smjehanzeb — Wed, 31 May 2023 14:51:42 GMT

Appreciate your Response.