ANNOUNCEMENT - The community will be down for maintenace this Thursday August 13 from 12:00 AM PT to 02:00 AM PT. As a precaution save your work.
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
46846
Views
45
Helpful
29
Replies
Highlighted
Beginner

AMP for Endpoints Deployment

We have 1500 AMP for Endpoints licenses - I just watched a video on deploying them - from what I saw I would need each pc to go to https://console.amp.sourcefire.com portal page and download these individually.

1 - How would I get a login for the sourcefire site (don't have it)

2 - Is there an easier way to deploy this for 1500 users????

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

Hello,

Hello,

     You can download to each machine as you described, or you can push the installer out using SCCM or similar tool for windows. When installing via SCCM, you will need to send the installer downloaded for the group you want those machines in. For example, if you have 3 Windows groups, you would need to download the connector for each group and push them to the appropriate machine groups so that they register with the cloud under the right group. For more information, please refer to the deployment guide:

FireAMP Deployment Strategy Guide : http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-cloud/FireAMPDeploymentStrategy.pdf

Currently, we are working on an MSI installer that can be pushed out via GPO for Windows as well, but I do not have a date for that feature to be released.

Also, the portal for AMP for Endpoints is now https://console.amp.cisco.com . The sourcefire domain will be retired, the cisco domain is the same portal, but will be the persistent address.

I hope this assists you in your deployment.

Regards,

Matt J

FireAMP TAC Engineer

View solution in original post

29 REPLIES 29
Highlighted
Cisco Employee

Hello ,

Hello ,

If you need a Fireamp account , first of all you should contact your accounts team.

Your accounts team will do that process and get you the Fireamp account login.

Reference link :-

http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-cloud/FireAMPDeploymentStrategy.pdf

Rate and mark correct if the post helps you

Regards

Jetsy 

Highlighted
Beginner

Cisco has an updated

Cisco has an updated deployment guide located at:  

https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20Deployment%20Strategy.pdf

I don't see any reference to the MSI in this version.

Highlighted
Cisco Employee

Hello,

Hello,

     You can download to each machine as you described, or you can push the installer out using SCCM or similar tool for windows. When installing via SCCM, you will need to send the installer downloaded for the group you want those machines in. For example, if you have 3 Windows groups, you would need to download the connector for each group and push them to the appropriate machine groups so that they register with the cloud under the right group. For more information, please refer to the deployment guide:

FireAMP Deployment Strategy Guide : http://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-cloud/FireAMPDeploymentStrategy.pdf

Currently, we are working on an MSI installer that can be pushed out via GPO for Windows as well, but I do not have a date for that feature to be released.

Also, the portal for AMP for Endpoints is now https://console.amp.cisco.com . The sourcefire domain will be retired, the cisco domain is the same portal, but will be the persistent address.

I hope this assists you in your deployment.

Regards,

Matt J

FireAMP TAC Engineer

View solution in original post

Highlighted
Beginner

Hello !!

Hello !!

I am new to AMP and need complete deployment documentation for AMP for Endpoints and a trial version for testing (if any)purposes. Please provide relevant details so i can proceed accordingly,

Thanks,

 

Highlighted
Beginner

Re: Hello,

Hi,

 

I know I'm re-opnenning 3 years old ticket

just wondering did you finish the MSI package?

 

Regards

Highlighted
Hall of Fame Guru

Re: Hello,

Cisco isn't distributing one directly; but you can create your own following the instructions in this thread:

https://community.cisco.com/t5/security-discussions/amp-for-endpoints-msi-file/m-p/3566521

Highlighted
Beginner

We use Kaspersky and have

We use Kaspersky and have deployed it silently that way.

Highlighted
Beginner

Hi Kyle,

Hi Kyle,

I too would like to go about it this way. We use EndPoint Sec 10.  I assume you created a task to "install an application remotely" and chose all your endpoints and ran the task, is this correct?  I have a couple questions if I go about it this way as well.

  1. Did you just load the executable in the task to "install application remotely" (If youre using EPS10)
  2. How nice does AMP play with Kaspersky Endpoint Sec 10? (If you have this version)
Highlighted
Beginner

Did that MSI for GPO ever

Did that MSI for GPO ever happen?

Highlighted
Cisco Employee

That feature has not been

That feature has not been made available in the AMP Portal yet.

Highlighted
Cisco Employee

Matt,

Matt,

 Do you have the latest AMP4E Deployment Guide ?. 

thanks

Highlighted
VIP Advocate

The latest (Apr 2017)

The latest (Apr 2017) Deployment Strategy and Quick Start Guides can be found here:

https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20Deployment%20Strategy.pdf

https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20Quick%20Start.pdf

Highlighted
Beginner

Re: The latest (Apr 2017)

The deployment strategy guide for AMP for endpoints straightaway talks about creating exclusions on the portal. But for any engineer new to the product, it doesn't explain well that how to get started with the portal in chapter 2. It seems to just assume the user would know the url of the portal and information to set it up.

I found a much better and simple explanation on this blog https://theinternetworkblog.wordpress.com/2017/08/09/deploying-amp-for-endpoints/ 

Highlighted

Hello Matt!

Hello Matt!

about the MSI file, do you have any update about the release date of that file?