Endpoint Security

In our VMware Horizon 8.1 environment with Windows 10 20H2 linked clones we are implementing AMP for Endpoints.The installation with the Identity Persistence (setup.exe /R /S /goldenimage 1) works fine. Also the Ubuntu Local AMP update server works w...

Thanks for attending our March ATXs session! Here’s the post-session resources for easy reference. New to ATXs? An ATXs session, offered at no cost, is an hour of real-time learning led by Cisco experts, who will answer your technology questions thro...

Good morning. When I do an API call looking for any info about specific IPs, for groups, using this URI:https://api.amp.cisco.com/v1/computers?internal_ip=10.0.0.1&internal_ip=10.0.0.2&internal_ip=10.0.0.3&internal_ip=10.0.0.4&internal_ip=10.0.0.5&in...

Hi Everyone.   I'm trying to write a guide for our analysts on how to perform threat validation when receiving Malicious Activity Detection alerts. I have a filter set up in AMP that emails the groups when certain events are observed. Specifically we...

Hello All, Today after a month of using ISE my users were not able to authenticate but machine authentication succeeded. Please help. This is the error i got from the live logs Issued PAC type=Machine Authorization with expiration time: Wed Mar 24 20...

AMP sometimes sends massive alerts about exploit prevention. Mostly its from IEXPLORE.exe, Acrord32.exe, RdrCEP.exe, EwUpdater.exe.  Why is this happening? they are all safe apps. Is there anyway to stop this alerts? besides disabling the option?  

Does AMP Detect Port Scanning ? if yes any orbital query or  Event id or Detection name to check ?  

Hello Cisco Community,  We've recently deployed ISE 2.7 and after joining each device the status was green.  No over time I'm seeing a large amount of the status column being greyed out, what's happening here?  The devices are still connected and the...

Is there any requirement that the order of authentication when using ISE is 802.1x and failover to MAB, instead of trying MAB first, and then 802.1x? If the 802.1x is tried first, there is a timeout before MAB is tried and some clients are too impati...

A customer has performed a security test/search in their network infrastructure, and the Room Kit unit was listed as a "SNMP vulnerability" in relation to MS02-006. Anyone know what this actually means, and if this is an issue that need to be resolve...

Hello,  I would like to ask some questions about the operation of AMP 1. When upgrading an agent, the reboot after needs to be done with privileged account?2. Is there a site that hosts IOC xml files?3. Is there a way for AMP to automatically upload ...