Does Cisco amp supports Antibot

[sv7]

Hi all,

Does Cisco AMP Supports Anti bot ? . My Requirement is something like this

it should complements existing endpoint security solutions by monitoring network ports for rogue activity and detecting infected internal endpoints sending command and control traffic back to a host on the Internet.

Please help me 

[sv7]

Any help pls

[johnosn]

Hello @sv7 

Are you by change referring to the Check Point Anti-bot software blade?

If so, then there are two items that you would want to investigate. The first is Cisco Secure Endpoint "Device Flow Correlation". The best place to get a quick summary of that is the "Device Flow Correlation Detections" section of Appendix A in the Secure Endpoint User Guide. Device Flow Correlation covers known malicious locations on the Internet.

For unknown malicious Internet locations, you would want to investigate Global Threat Alerts. See Chapter 23 of the Secure Endpoint User Guide for information on that. Global Threat Alerts ingests your web proxy logs and uses machine learning to find probable compromises based on the behavioral models of other malware and potentially unwanted applications. These results are then brought into Cisco Secure Endpoint which correlates the network and host activity together.

I am not familiar with Anti-bot, but that may be what you are looking for.