Question When I run a search in AMP4E console, I get results showing that a file was encountered recently by a number of hosts in my environment. When I do the same search in Cisco Threat Response (CTR), no targets are returned, and I get the error message:   "There was a client error in the AMP module: API client does not have write access [403]" Why is this and how can I fix it? Answer This condition is likely due to the combination of an AMP API key that is set as read-only, combined with setting the AMP module in CTR as "Act in the Name of the Active User". When CTR calls AMP for results, a dynamic API key is created using your native credentials, which lacks the privileges to find hosts in the AMP environment. Workaround You can either: 1. Disable the setting "Act in the Name of the Active User", and you should see all the hosts you're expecting in your query, or 2. Change your AMP API key to read/write. ... View more

Question I understand there are some differences in what is currently supported in CTR for Americas opposed to EU. Can you please confirm the differences and timing? Answer Cisco Threat Response (CTR) is available in 3 global regions.  Customers from any region can self-provision accounts in Americas or Europe using Instant Access. Due to the way that CTR accesses data, customers will find CTR performant from any part of the world, giving freedom to use whichever cloud provides the features desired. Further, customers can easily configure product APIs to connect to any region. (Note that Umbrella centralizes geo settings within the dashboard). Here are the differences in each region:   Americas Europe Asia Pacific Instant Access ✓ ✓ not yet committed AMP for Endpoints ✓ ✓ ✓ Umbrella ✓ ✓ ✓ Threat Grid ✓ ✓ connect to Americas or EU Threat Grid instance SMA Email ✓ Requires SMA 12.5 not yet committed Firepower ✓ Requires 6.5 for direct cloud eventing or 6.3+ to send via proxied syslog  not yet committed   ... View more

Question Which third-party integrations does Cisco Threat Response (CTR) support? Answer Cisco Threat Response provides integration with many security products offered by Cisco, including Talos, AMP, Threat Grid, Umbrella, Email Security, Next Generation Firewall (NGFW), and Firepower. The product is adding more integrations every month, with Web Security, Stealthwatch, and Duo coming soon.   CTR natively supports Virus Total within the product. Third party integration via the public cloud APIs is available. You'll also find impressive integration underway with products like Signal Sciences.  Also take a look into the CTR browser extensions for Chrome and Firefox. http://cs.co/CTR4Firefox http://cs.co/CTR4Chrome ... View more

Question I'm having a problem with Cisco Threat Response (CTR). How can I get support? Answer You can get help from Cisco Support. Since CTR is licensed with other Cisco products, you need the contract number for one of your Cisco security products to start a case. If you have trouble finding your contact number, you can engage Cisco Support (also known as Technical Assistance Center - TAC), via 1:1 chat or placing a phone call, listed on the support page. You can find all the information you need here.   When creating your case, simply add your contract number from your related product (NGFW, SMA, etc.). When selecting a product, search for "Cisco Threat Response" in the technology list. ... View more

Question I'm using Threat Response and would like to add more users to my organization so we can share casebooks, modules, and snapshots. How do I do that? Answer If you have an AMP EP cloud or Threat Grid cloud account, add users to your organization via that console. Otherwise, you can add additional users via the CTR account portal. What is an Organization? Users in the same company should be in the same product organization, so they can share configured modules, casebooks, and snapshots. Organizations are native to each product (AMP, Threat Grid, Umbrella, Cisco Security, etc.). ... View more

Question I would like to use Threat Response and keep my traffic local to the European Union. How do I do that? Answer You can access our EU region. Note that the account you use is local and distinct to the EU. Your AMP EP, Threat Grid, or Cisco Security account is created and distinct for the EU, and will not match accounts you may have created in other regions. ... View more

Question I've heard that Cisco Threat Response is free and allows me to hunt through my security alert data and block threats. How can I get an account? Answer Threat Response is free (included with a valid Cisco Security product). To get access, you can simply go to the login page and create an account.   Before you create a new account, here are a few things to remember: If you already have an AMP for Endpoints account, choose "Login with Cisco Security" and use that account. You don't need a new account. If you have a Threat Grid account, choose "Login with Threat Grid". You don't need a new account. If someone in your organization has access to Cisco Threat Response, AMP for Endpoints, or Threat Grid, don't create a new account. Instead, ask them to invite you to their organization, so that you can share modules, devices, casebooks, and snapshots. They can go to the respective user consoles for each product to send you an invitation. When you create a new account, the first thing you'll do is configure a related security product to activate your account. ... View more

Question Why am I receiving timeout messages when I conduct queries in Cisco Threat Response (CTR)? I see, "2 of 3 enrichments complete with 1 Alert"   When I open the alert, it says, "There was a timeout in the 'AMP for Endpoints' module. Retrieved 55 computers, processed AMP events from 10 of 55 computers." Answer This may happen occasionally on large AMP deployments. Here's what's happening: CTR implements a 60 second limit for all enrichments, and will wait for that period of time to retrieve results from any enrichment, including AMP, Umbrella, etc. We are exploring a model for long-running enrichments returning progressive results. CTR will also truncate results to a maximum number of sightings per observable per module. As our integrating products APIs become more performant and tuned to CTR use cases, we will continue to expand the scope of what CTR is capable of ingesting, aggregating, and displaying to the user. Workaround For exhaustive information during an investigation, go to the original sources. In this case, since you know which observable had the hits, and timed out, you can easily pivot on that observable into AMP. ... View more

This guide walks you through the Umbrella APIs and how to use them with Cisco Threat Response. ... View more

I have just received an email that looks like the attached (redacted) email telling me that I need to activate my Cisco Security account. What do I do with this?   Answer 1. This is an entitlement for a Cisco Security account. It is used to access the following applications: AMP for Endpoints Cloud (paid subscription needed) Threat Grid (paid subscription needed) Threat Response (free) 2. There is no charge to create and setup the account - it is free. 3. Clicking the link will allow you to create a new account, or login with your existing account and "claim" this entitlement. 4. If you have an AMP for Endpoints Cloud account already, it will work here, you don't need to create a new account (AMP for Endpoints accounts are subsets of Cisco Security accounts). 5. The account is created in our North America cloud. ... View more

Here is a getting started guide for Cisco Threat Response and Umbrella:   https://cs.co/ctr_umbrella ... View more