Im relatively new to Cisco AMP's Orbital Search, but looking for an easy way to have the Orbital Search query a client machine and pull all events 4624 and also want to further filter into logon types 2 (internative logon at keyboard) and type 7 (unl...
Forum Posts
Once in a while I get a high CPU alert on one of our VM file servers. Looking at the Windows Resource Monitor shows Cisco AMP for Endpoints Connector with high CPU usage. There is no scan running and the connector shows that the service is stopped. I...
I have a number of the CIS Modified 8841s. Once they are programmed the Admin Settings is removed. How do you factory reset these phones so that you can see the MAC Address?
Hello,I have to deploy a new FTD 1010 to a remote location. I will be on site later this week, however I don't have the static IP address information yet from the ISP. We deploy the 1010's via the FMC in our data center before we deploy. Is there a w...
Resolved! AMP for Endpoints NAM/EU Compliance
Hello, We have an active instance of AMP for Endpoints deployed in NAM. We are looking to extend our endpoint coverage with connectors in EU. Will the AMP console/cloud provisioned in NAM effect GDPR compliance if we deploy connectors in EU? Thanks!
Hi All, I have created some path exclusions on my AMP console but my question is this, within a path exclusion will this also exclude any processes from being scanned which launch from within said path? Example: Path Exclusion C:\Program Files (x86)\...
There was an instance where Cisco AMP was detecting an infected file and while quarantine and moving to "Quarantine" folder it was renaming to .DAT files. Do Cisco AMP rename threat detected files while moving to Quarantine?
Resolved! Cisco AMP4E deployment components
Dear Community, I am thinking of deploying Cisco AMP4E to my endpoint computers. Based on my readings, there are public cloud and non public cloud deployment approaches. My request is to install the antivirus in my endpoints and use the public cloud...
I read that AMP for endpoint doesn't have the capability of controlling removable media and is more focused on threat and malware etc .. but does Cisco intend to have this features included in the near future. Thanks
I have accidentally set AMP Product version to 7.2.11 on the policy and servers got upgraded from 6.2.9 to 7.2.11 and pending for reboot. However since these are production servers i cant reboot and they are marked as "Unprotected". How can i rollbac...
how to exclude process without path
I joined cisco recently . i would like to know about AMP for Endpoints and AMP for Networks AMP for endpoints used to scan/discover laptops, desktops , server irrespective of OS? AMP for Networks used to scan/connect devices like Switches, routers ,...
Dear all, When I do install AMP for endpoints in any device at the office, they're automatically are inserted into the "None" policy instead of the Windows Policy. This is a new thing, cos in the last months we didnt get this kind of results.How can ...
Hi there, Is there a way to search for duplicate clients (licenses) in AMP for Endpoints portal? I have looked for this option but I can't find it. Thanks. Regards, Sam
Hi Team, Is it possible to download a file that has already been quarantined?The file is malicious and I don't want to restore it on the user host before to download it. Thanks
