Default AMP Policies

[rsharp001]

We are beginning the deployment of AMP for endpoints.  The current policies were auto-generated 2-3 years ago when the main account was originally created, the product has not been touched until now.  In a "training" class the instructor said we may be better off recreating them from scratch since the product has changed quite a bit since then.

- Any validity to this?

- Can we just blow up/regenerate new base policies?

Thanks!

[Matthew Franks]

If you create a new Exclusion Set, it will add the latest default exclusions to the new set. So yes, if it has been that long since you touched it I recommend creating new exclusion sets so you can have the latest default exclusions in place.



Thanks,

Matt

[rsharp001]

Thank you Matthew.

https://www.cisco.com/c/en/us/support/docs/security/sourcefire-fireamp-endpoints/118341-configure-fireamp-00.html 

I found this document that highlights some of the basics, I assume it would be a solid base for my new Exclusion sets.  From there I have started making notes of special applications we have that may need additional Exclusion sets.

EDIT... didn't include the document link