Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About David Janulik
David Janulik
Cisco Employee
Ransomware, cloud, cyber security. Windows endpoint security.
Recent Badges
Stats
Member since
05-27-2016
53
Posts
35
Helpful
5
Solutions
Created by
David Janulik
in Advanced Threats
in Advanced Threats
01-28-2019
05:47 AM
01-28-2019
05:47 AM
And firepower is streaming API request to AMP to get access to Cloud intelligence for such file SHA. Once AMP retrieves that file disposition (clean, malicious, unknown), the status is visible in Firepower.
... View more
Created by
David Janulik
in Advanced Threats
in Advanced Threats
01-28-2019
05:40 AM
01-28-2019
05:40 AM
I believe there are couple of mixtures in terms of integration. AMP performs a real time cloud query for file SHA. Than we have client based IOC scan, and only AMP administrators can trigger this, once they know what artifact they're looking for. The last is scheduled scans, which are fairy redundant, because of an immediate cloud query request.
Beside this AMP offers system protection and Exploit protection.
Maybe you can fire up an enhancement request to our PM, if you think such feature will be beneficial.
... View more
Created by
David Janulik
in Advanced Threats
in Advanced Threats
01-28-2019
03:02 AM
01-28-2019
03:02 AM
If the file gets TG score >95, AMP will retrospectively quarantine it.
... View more
11-28-2018
07:40 AM
You can use "Last Seen" to filter out endpoints over certain time period.
... View more
Created by
David Janulik
in Advanced Threats
in Advanced Threats
11-27-2018
07:01 AM
11-27-2018
07:01 AM
AMP scans PE header to check, if file is supported. It does not need to download data, from the onedrive to local disk. This is a feature of onedrive, if you or e.g. photo editor, or other application is accessing the file stored in the onedrive, it downloads it to a temp folder. This file is subsequently uploaded once read,execute or modify finishes. Scans are redundant as AMP checks its sha against cloud intelligence, in the action specified per policy. This is typically copy/move and execute.
... View more
Created by
David Janulik
in Advanced Threats
in Advanced Threats
11-08-2018
02:07 AM
11-08-2018
02:07 AM
Hello,
Security Ops rely on API to get e.g. syslog event. API call would let you get description of behavior indicators. You should be able to pull the name, title, description and lots of other indicator data from it.
Go into your dashboard if you do not yet have an API key and you can establish one under Accounts > API Credentials.
Cisco AMP has gitub source to start with API.
https://github.com/CiscoSecurity/amp-01-basics
Or you can have a look at official documentation, as below:
https://api-docs.amp.cisco.com/
Regards
David
... View more
Created by
David Janulik
in Advanced Threats
in Advanced Threats
11-06-2018
03:02 AM
11-06-2018
03:02 AM
Hello,
AMP agent sends events to AMP console, for further details. The typical Syslog is not paired in any way with AMP agent. If Security Operation wants such output, need to use API. With REST API you are able to pull data, or run them regulary using e.g. cron jobs.
Hope that answers your question
David
... View more
Created by
David Janulik
in Advanced Threats
in Advanced Threats
05-03-2018
07:40 AM
05-03-2018
07:40 AM
HI,
you stated: "If a user has a malicious attachment in an email and opens it, the activation would be associated with some other process other than outlook, correct?"
The file opens in associated application e.g. word. If the Word macro is malicious, than it can harm your computer. You should have file dynamic analysis configured in your AMP account, to mitigate zero day attacks.
Let me know, if I answered your question.
David
... View more
Created by
David Janulik
in Advanced Threats
in Advanced Threats
04-23-2018
01:40 AM
04-23-2018
01:40 AM
Hi
please open a ticket and get this escalated to Tier3. We can get backend logs filtered to see most frequent lookups per day/connector.
David
... View more
Created by
David Janulik
in Advanced Threats
in Advanced Threats
01-19-2018
03:08 AM
01-19-2018
03:08 AM
Hi,
for a detailed analysis, please open a ticket with following logs inc.
/var/log/cisco/
I can give few advice's at this moment:
get the agent PID ps aux | grep -i amp or stop the daemon with "initctl stop cisco-amp"
kill the agent process and see if it has any effect on high cpu. If the CPU gets healthier, we can help you to tune exclusions for most checked file cloud query lookups.
Policies - File Mode make sure you do not have "On Execute Mode" set in your policy.
Best Regards
David
... View more
Created by
David Janulik
in Advanced Threats
in Advanced Threats
01-19-2018
02:53 AM
01-19-2018
02:53 AM
Hi
every agent checks periodically based on a heartbeat interval against cloud.
This time is specified per policy, as you see it in the screenshot.
Regards
David
... View more
01-19-2018
02:47 AM
Hello,
I am not sure, what do you mean with policy to block all PDF and executables.
If we get to the AMP console, you can blacklist a specific file SHA. You can block network connection e.g. specific ports, CIDR IP block or specifig IP address.
Did you try any of these?
Outbreak control > Custom detections
Outbreak control > Application blocking
Outbreak control > Network > IP blacklist
Regards
David
... View more
01-17-2018
04:11 AM
Hi
this is possible as per screenshot. It's up to logged in admin user, what subscription chooses.
Each admin can have different or none email subscriptions.
as per documentation:
When you select a user account you can also view the subscriptions for that user. The Subscriptions list displays any events and reports they have subscribed to.
Regards
David
... View more
01-17-2018
02:39 AM
Hi,
From events > filter choose e.g. threat detected > You see the button not subscribed.
This button opens a menu with immediate, hourly, daily, weekly, or monthly notifications. There are options to receive immediate alerts as one email per event.
Hope this helps
David
... View more
01-28-2019
And firepower is streaming API request to AMP to get access to Cloud
intelligence for such file SHA....
01-28-2019
I believe there are couple of mixtures in terms of integration. AMP
performs a real time cloud query...
Created by
David Janulik
in Advanced Threats
01-28-2019
01-28-2019
If the file gets TG score >95, AMP will retrospectively quarantine it.
11-27-2018
AMP scans PE header to check, if file is supported. It does not need to
download data, from the oned...
11-08-2018
Hello, Security Ops rely on API to get e.g. syslog event. API call would
let you get description of ...
11-06-2018
Hello, AMP agent sends events to AMP console, for further details. The
typical Syslog is not paired ...
Created by
David Janulik
in Advanced Threats
05-03-2018
05-03-2018
HI, you stated: "If a user has a malicious attachment in an email and
opens it, the activation would...
Created by
David Janulik
in Advanced Threats
04-23-2018
04-23-2018
Hi please open a ticket and get this escalated to Tier3. We can get
backend logs filtered to see mos...
01-19-2018
Hi, for a detailed analysis, please open a ticket with following logs
inc. /var/log/cisco/ I can giv...
Created by
David Janulik
in Advanced Threats
01-19-2018
01-19-2018
Hi every agent checks periodically based on a heartbeat interval against
cloud. This time is specifi...
01-19-2018
Hello, I am not sure, what do you mean with policy to block all PDF and
executables. If we get to th...
01-17-2018
Hi this is possible as per screenshot. It's up to logged in admin user,
what subscription chooses. E...
Public Statistics
| Date Registered | 05-27-2016 07:38 AM |
| Date Last Visited | 02-04-2019 03:03 AM |
| Total Messages Posted | 53 |
| Total Helpful Votes Received | 35 |
Helpful Votes From
