topic Re: How Cisco AMP Endpoint take action? in Endpoint Security

How Cisco AMP Endpoint take action?

RoberSamir00332 — Wed, 21 Jul 2021 23:48:52 GMT

Hi All;

i want to know how Cisco AMP Endpoint take action when it detect a Malware on the PC

Regards;

Rober

Re: How Cisco AMP Endpoint take action?

Troja007 — Thu, 22 Jul 2021 14:23:47 GMT

Hello @RoberSamir00332,
there many different ways Cisco Secure Endpoint takes action on Malware.

Starting with traditional File scanning, File scanning for Scripts (AMSI integration), Malware Grouping, Machine Learning, where the Endpoint quarantines a file and also stops a running process.
There are other engines, which are protecting the memory like ExPloit Prevention and System Process Protection. These engines protect against memory based attacks.
Behavioral Protection Engine is the newes enhancement on the endpoint. It detects and blocks complex malicious behavior on the endpoint. The engines uses am expressive event pattern matching language designedby Cisco.
Cloud IOCs: The endpoint sends file, network, process and command line activity to the backend. This data is processed back for 7 days. The result is a Cloud IOC or a retrospective detection.
Based on Cloud IOCs, there are automated Post Infection Tasks available, like isolating the endpoint from the network.

Maybe useful, the screenshot compares the difference between a Cloud IOC from the Backend and a Behavioral Protecton Event.

Greetings,
Thorsten

Re: How Cisco AMP Endpoint take action?

bezik — Fri, 23 Jul 2021 05:00:26 GMT

A very interesting answer. thanks💃

Re: How Cisco AMP Endpoint take action?

maciek_smolak — Sun, 25 Jul 2021 16:22:06 GMT

💃

Re: How Cisco AMP Endpoint take action?

Troja007 — Mon, 24 Feb 2025 19:24:05 GMT

Hello all, the new TDM includes the drawing above and much more... 🙂

Re: How Cisco AMP Endpoint take action?

Ken Stieers — Mon, 24 Feb 2025 19:26:56 GMT

TDM ???

Re: How Cisco AMP Endpoint take action?

Roman Valenta — Mon, 24 Feb 2025 20:08:33 GMT

Hi Ken, I think Cisco Secure Endpoint "TDM" refers to the threat detection and management capabilities within the Cisco Secure Endpoint platform. Don't like acronyms either they change all the time 🙂🙂

Re: How Cisco AMP Endpoint take action?

Troja007 — Wed, 05 Mar 2025 20:46:56 GMT

Hello Ken,
TDM = Technical Decision Maker Presentation.
Cheers,
Thorsten