Differences between AMP and Malware protection in the ASA firepower

[Anthonize Rajaratne]

Hello, 

Do you know what are the main differences between installing AMP on end devices and activating malware services in the Firesight management Center?  

Aren't they do the same or is there any big difference? 

Thanks in advance. 

[Philip D'Ath]

I don't know the answer.  I think it adds things like re-mediation, and greater control since it can see the actual executables running.

http://www.cisco.com/c/en/us/products/security/fireamp-endpoints/index.html

[yogdhanu · Accepted solution]

Hi

There is difference. AMP on client is end point protection which is controlled by cloud connection and Firesight management center console can be (optional) connected to it to gather client reports as well.

Whereas activating malware services in FMC (firesight) is like a network based AMP which can detect/prevent malware from traffic which is passing through a managed sensor.

End-point AMP is more for client who move around and are not always behind a protected sensor/firewall.

This might shed more light.

http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-cloud/FireAMPDeploymentStrategy.pdf

http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-cloud/FireAMPUserGuide.pdf

Thanks

Yogesh