Chrome Plugins for AMP Threat Grid and OpenDNS

[pauld2]

Authors	Michael Auger, Nicholas Frangia - Advanced Threats Security Solution Architects
Organization	Cisco

From members of the Cisco Advanced Threats Security Solution Architecture team, specifically Michael Auger and Nicholas Frangia, a set of Chrome plugins have been developed that allows a user to search the AMP Threat Grid, and OpenDNS cloud platform for samples that match on an IP address, file hash, or host name, from within the Chrome web browser.

IMPORTANT TO NOTE:  You need a valid user id and password to log into the AMP Threat Grid platform and/or OpenDNS. 

Imagine that you are looking at a web console, or a research web page on a blog.  By simply selecting a piece of text on a web page, and right hand clicking, the option exists use the selected text as search criteria.

In seconds, the results are shown inside the AMP Threat Grid portal:

This valuable extension enables security operations personnel, incident response analysts and threat intelligence specialists to quickly ascertain if an IP address, or a host or file hash has been associated with files submitted to the AMP Threat Grid cloud. 

Integrate this tools into your other security tools, and speed up your IT security triage process using the power of Cisco’s AMP Threat Grid threat intelligence.

The download link for:

AMP Threat Grid only Chrome plugin: https://chrome.google.com/webstore/detail/threat-grid-search/flmngebmblpgkilhbkpkhenindbpodbp

AMP Threat Grid and OpenDNS plugin:

https://chrome.google.com/webstore/detail/threat-grid-and-opendns-s/kkhnimcjoojpeihhdgnopjoekhhjeaja

[Troja007]

There are new Cisco Chrome Extensions on the rise, check out! :-)
https://chrome.google.com/webstore/detail/cisco-threat-response-cas/himjbijchjdfcpnihaajckmjlignpkmh

This tool will, from the upper right border of your Chrome browser:

• Pull all observables out of the entire contents of your currently loaded page
• Immediately give you the current verdicts on each of those
• Give you the full Threat Response pivot menu on each of those observables without even leaving the current page (including response actions like block file or domain)
• Allow you to pivot into the Threat Response investigate UI with the set of observables, or a filterable subset thereof