One of our customers had a malware attack on the critical servers hence in the process of a endpoint AMP PoV. The connectivity for these servers to Cisco cloud has been provided as per the documentation of FireAMP. But still getting an error of Policy update failed on few systems which are not able to then detect the malware.
Appreciate if someone has seen the same and advise for the same.
When I was doing this, I found the supplied firewall rules insufficient. I end up monitoring the client trying to do updates via ASDM and then added in rules to allow that traffic.
The rules are based on where you are in the world, so I doubt my rules would work for you.
