I am trying to stop the Secure Endpoint service to do testing and I am not able to do so.Following these documents:https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.htmlhttps://www.cisco.c...
Forum Posts
Hi Everyone -Good day! I am new with CSE and part of my task is to upload IOCs using XML files from CISO. I got an error when I uploaded the file from CISO.The Endpoint IOC is not currently able to be validated according to the Cisco IOC specifiation...
Is there a way to safelist or create an exclusion for this benign powershell command without safelisting cmd.exe or powerhell.exe - just the actual Command parameter? These events are classified as "Command Obfuscation With Symbols" compromises and ...
Good morning everyone, I have a problem that on some machines the Service Status is in Stopped.Would anyone know what might be causing this?
We have been having good luck with basic iPhone management over the past year but the past week we have been unable to enroll devices using the Apple configurator. When setting up an iPhone the device acts like all is good until it try to register fo...
It appears there's no "help" option in the training labs. I don't think the lab is complete as I'm unable to complete all functions in the lab. In particular, the environment module we import into our Python script doesn't have anything inside of it ...
Hi , can any one please help me out to receive daily email alerts of complete detection. I am using SourceFire v5.3 console and have tried creating a filter in "Analysis --> Detections/Quarantine" then subscribing a daily detections email alert, howe...
Looking for some clarification or guidance on how to best set up Zoom Rooms when using Meraki MDM. We have our room controller iPads configured using MDM and kept the controller app open using the MDM-level single app mode. The downside to this is th...
Hey all - I have numerous endpoints that are showing as not being seen in xx amount of days in the portal. However if I remote into these endpoints and check the secure endpoint application it shows as connected, pull down updates and has even update...
Good day all! From time to time, I find that there are several of our machines that have their service stopped with Secure Endpoint. I haven't found what has been stopping it, but has anyone seen this and know what has been causing this? And is there...
Curious if there is way to mark a potential compromise as resolved with the API. I would like to automate some known false positives that routinely appear.I didn't notice any POSTs in the current version of the documentation (Secure Endpoint API - C...
Is there an option in Cisco FMC to block Hash via EDL method, similar to the option available for blocking IP, Domain, and URL via EDL in FEEDs in security intelligence section? Currently, it only allows manual creation and upload of a file list cont...
I've added device contol to my polocy for Windows devices. I am using the default Global Policy with the setting to Block and notify users. It has had a week to replicate but it isn't working. Users are still able to attach a usb device and either...
When I'm going through my list of computers to check and fix those with a high 'Kenna Risk Score', I sometimes get the feeling that a particular client's score is not up to date. For example, immediately after installing a missing Windows update on t...
Hi,Just noticed that new button just want to be sure about what it does.thanks
