Endpoint Security

Anybody ever have issues uninstalling AMP? I have a handful of computers still with v6.2.5 on them that I have been trying to upgrade to 6.2.9, but the upgrade fails because the 6.2.5 service can't be stopped. Even after a reboot, the service just ca...

Hello, evaluating AMP for Endpoints first configuring policy to Audit, and after that first scan I change computers to group of Protect, check image attached, and my question is, how to apply the actions??  There are files detected that I delete it a...

Hello, On one of my host I see 3 threats 1. Category=CnC Connected, Event Type=Intrusion Event - malware-cnc and Description= The host may be under remote control. 2. Category=Impact 2 Attack, Event Type= Impact 2 Intrusion Event - attempted-admin an...

Hello,  ClamAV a project of Talos by Cisco falsely detected several files of Luminati SDK as a virus, type: Win.Packed.Icloader Yesterday I have submitted the files at https://www.clamav.net/reports/fp and didn't got confirmation email or link to fol...

Hello, We need to archive some events so they're not lost forever after 30 days. I believe Splunk can integrate with the AMP API and can do this but alas we do not have Splunk or any other decent SIEM for that matter. Any bright ideas on how we could...

I keep getting this alert from AMP for Endpoints several times per day for the same endpoint.  I can't really find the source of it.  Device Trajectory is just showing me that a file associated with it is called c:\windows\system32\eac_usermode_19230...

I am having a issue to update threat grid  in lab ,  it shows the following error when doing update.  ssh: connect to host appliance-updates.threatgrid.com port 22: No route to host Failure during transfer   Dirty interface is able to ping internet a...

Windows Server 2012 R2, fully updated, physical server. Installed AMP connector version 6.2.5.10848 last night. Since then the server has crashed/rebooted twice. Seeing several event ID 36887 Schannel errors since the install - "A fatal alert was rec...

Team, got the email of a bug for amp. Anyone got the BugID, details, or severity? Thx, RickCisco AMP for Endpoints Announcement - AMP for Endpoints Connector downloads --- A bug has been identified in the installer of AMP for Endpoints Connector for ...

Can some kind dev fix the issue where when a file is fully downloaded AMP triggers on a signature on the file.crdownload or whatever your browser du jour decides to temp name downloads, but before AMP can act the browser renames it to the correct fil...

Hi I am working on some case where the customer asked me about the no. VM (for sandboxing) running on the Threat Grid firewall. I neither find it in the Admin guide nor in datasheet and any other portal. Could someone help me on this please?  Regards...