Can AMP kill and already running malicious process?

[keitholsen]

Hello,

If AMP detects a malicious executable that's already running, will it kill the process, or can it only prevent new instances from starting?

Thanks!

Keith

[csco12589127 · Accepted solution]

Block malware in real time

AMP automatically detects and blocks threats in real time using global data analytics, machine learning, fuzzy fingerprinting, rootkit scanning, and a built-in antivirus engine.

From Cisco:Cisco Advanced Malware Protection (AMP) for Endpoints - Cisco

AMP scans continiously and blocks somehow if any found.

[brmcmaho]

The AMP for Endpoints connector is able to terminate processes if they are found to be malicious, yes.  Note the "Monitor Process Execution" setting under the File tab of your AMP policy settings.

[sofian.said]

Yes AMP will be able to kill the process