The future of AMP for Endpoints💃

[michalsabat]

Hi.

What could be the next step in AMP in the future?

What Cisco could improve or what do You want Cisco to improve

[Kombi]

They need a Linux Docker client and larger Linux client base. 

Docker to us is huge for us and for anyone using auto build and scaling in the cloud.

Amp needs the ability to reclaim a license for Cloud nodes since they can be scaled and torn down daily. 

SentinelOne, who supports docker also has the ability to reclaim a license after a no call in for 24 hr based on the group the node is in

[Net-Runner]

Supporting Docker containers would open a huge new market to Cisco AMP.

I know that the organization that I work for uses Dockers extensively.

I like that option of reclaiming licenses in 24 hours.

It would also come in handy with EC2 instances. 

[Net-Runner]

I am pretty sure that if AMP were to support Docker containers the organization I work for would migrate from Carbon Black (Which already supports Docker Containers) to AMP in a heartbeat. 

[rikaragoza]

Thanks for posting this!   Also quite interested in this topic! 

[Troja007]

Hello all,

we recently added Ubuntu support to the connector. This was also a major step, as the connector now is not depending on a deep kernel integration any more. This makes the support for other Linux distributions easier.
Behavioral Protection engine was added to the connector, which was a major step for detection and meeting ATT&CK criteria.

The next big step will be the unified endpoint: this means AMP4E, Umbrella, Any Connect and DUO will be included in one single agent.

For any other stuff, you may ping your Cisco representativ getting more insights into the official roadmap.

Greetings,
Thorsten