APP is a third party product from Agari... you put a sensor in the mail flow, and the sensor hands the mail flow to the Agari cloud and figures out if its phising. Cisco ESA and CES now have a built in "sensor" so you don't have to sent mail to another box.
ETD is a Cisco product, focused on O365 (and GSuite?), where you journal mail to the Cisco ETD cloud, they process it, and then pull back mail that's bad (spam, virus, phish, whatever).
