AMP for Endpoints Deployment

[moody]

We have 1500 AMP for Endpoints licenses - I just watched a video on deploying them - from what I saw I would need each pc to go to https://console.amp.sourcefire.com portal page and download these individually.

1 - How would I get a login for the sourcefire site (don't have it)

2 - Is there an easier way to deploy this for 1500 users????

[Jetsy Mathew]

Hello ,

If you need a Fireamp account , first of all you should contact your accounts team.

Your accounts team will do that process and get you the Fireamp account login.

Reference link :-

http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-cloud/FireAMPDeploymentStrategy.pdf

Rate and mark correct if the post helps you

Regards

Jetsy 

[brian.moeller1]

Cisco has an updated deployment guide located at:  

https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20Deployment%20Strategy.pdf

I don't see any reference to the MSI in this version.

[majacob2 · Accepted solution]

Hello,

     You can download to each machine as you described, or you can push the installer out using SCCM or similar tool for windows. When installing via SCCM, you will need to send the installer downloaded for the group you want those machines in. For example, if you have 3 Windows groups, you would need to download the connector for each group and push them to the appropriate machine groups so that they register with the cloud under the right group. For more information, please refer to the deployment guide:

FireAMP Deployment Strategy Guide : http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-cloud/FireAMPDeploymentStrategy.pdf

Currently, we are working on an MSI installer that can be pushed out via GPO for Windows as well, but I do not have a date for that feature to be released.

Also, the portal for AMP for Endpoints is now https://console.amp.cisco.com . The sourcefire domain will be retired, the cisco domain is the same portal, but will be the persistent address.

I hope this assists you in your deployment.

Regards,

Matt J

FireAMP TAC Engineer

[aukhan111]

Hello !!

I am new to AMP and need complete deployment documentation for AMP for Endpoints and a trial version for testing (if any)purposes. Please provide relevant details so i can proceed accordingly,

Thanks,

[InformationSec]

Hi,

I know I'm re-opnenning 3 years old ticket

just wondering did you finish the MSI package?

Regards

[Marvin Rhoads]

Cisco isn't distributing one directly; but you can create your own following the instructions in this thread:

https://community.cisco.com/t5/security-discussions/amp-for-endpoints-msi-file/m-p/3566521

[Kyle Stewart]

We use Kaspersky and have deployed it silently that way.

[caseyg1802]

Hi Kyle,

I too would like to go about it this way. We use EndPoint Sec 10.  I assume you created a task to "install an application remotely" and chose all your endpoints and ran the task, is this correct?  I have a couple questions if I go about it this way as well.

1. Did you just load the executable in the task to "install application remotely" (If youre using EPS10)
2. How nice does AMP play with Kaspersky Endpoint Sec 10? (If you have this version)

[jstorlie1]

Did that MSI for GPO ever happen?

[Matthew Franks]

That feature has not been made available in the AMP Portal yet.

[yalmatra]

Matt,

 Do you have the latest AMP4E Deployment Guide ?. 

thanks

[Rahul Govindan]

The latest (Apr 2017) Deployment Strategy and Quick Start Guides can be found here:

https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20Deployment%20Strategy.pdf

https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20Quick%20Start.pdf

[damode]

The deployment strategy guide for AMP for endpoints straightaway talks about creating exclusions on the portal. But for any engineer new to the product, it doesn't explain well that how to get started with the portal in chapter 2. It seems to just assume the user would know the url of the portal and information to set it up.

I found a much better and simple explanation on this blog https://theinternetworkblog.wordpress.com/2017/08/09/deploying-amp-for-endpoints/ 

[Ricardo Francisco Praz Falcon]

Hello Matt!

about the MSI file, do you have any update about the release date of that file?