Hello Zhang   You can refer the following article for offline update process.   https://www.cisco.com/c/dam/en/us/td/docs/security/amp_threatgrid/threat-grid-appliance-offline-update-process.pdf   Regards Jetsy ... View more

Hello Zhang   I have recently come across a similar issue and as Matt suggested the error will be mostly caused by network level block. Most of the time we just allow the traffic in firewalls for the upgrade server and it should work but if you have any intermediate devices in between the TG and your firewall then it can also cause the same issue. Try running tracert command in any client which is in the same network as your TG and see which is the next hop and whether its reaching the destination specified.   Regards Jetsy ... View more

Hello  phonehome   As a quick step to check the successful communication, you can try running the following from any of the endpoint cmd.   C:\Program Files\Cisco\AMP\X.X.X\connectivitytool.exe   Once you run the script, it will generate a log file which is connectivitytool.exe.log on which you can check the connection status. But this will not help you if the connection break is happening intermittently.   Regards Jetsy ... View more

Hello    phonehome   After the reboot, does it reflects the latest connector version and is the connector status is still showing as connected or disconnected in the endpoint?A diagnostic support file from any of the endpoint would be helpful to verify the definition update logs to know more about the issue. As per my knowledge there is no force way of updating tetra definitions.    Also, can you verify if there is any connection break towards the tetra definition update server based on the cloud that you have registered with? Based on the server address you can even run a wireshark capture and leave it for a day in any of the endpoint client to see if there is any connection break. You can filter the packet capture and it  will help you to confirm if the communication is successful or not.     https://www.cisco.com/c/en/us/support/docs/security/sourcefire-amp-appliances/118121-technote-sourcefire-00.html   Let me know if you have any queries on same.   Regards Jetsy  ... View more

Hello Tony   Is this was something working previously? In the following link there are server address that you should allow for the successful tetra definition update based on the cloud that you have registered with. Just make sure based on the cloud (EU,APJC,NAM) allow the traffic and make sure no inspection happens on the same.   https://www.cisco.com/c/en/us/support/docs/security/sourcefire-amp-appliances/118121-technote-sourcefire-00.html   If its still doesnt work then its better to get a wireshark capture for a day or so from any of those workstation which shows definition outdated along with the diagnostics file and submit it to the Cisco TAC.   Just fyi there was a known bug which got fixed sometime back.   https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj58637/?reffering_site=dumpcr   But if the issue has started recently then please contact the Cisco TAC and we will help you on the same.   Regards Jetsy ... View more

Hello Tyler    If you think the file is not malicious then you can add it to the whitelist option and you can allow this file in your environment. But if you are looking for a global passing, then Cisco TALOS will have to review the file and update the disposition only if the file is not malicious or not showing any high threat score. If the file is not showing any malicious behaviour then TALOS will do the needful. As an initial step you can open the case with Cisco TAC and they will involve the TALOS team to verify the same. Please provide the file sample along with the sha value while opening the case with Cisco TAC.   Regards Jetsy    ... View more

Hello Team   Hello   If there is already an existing antivrius running in the endpoints then we would recommend you to disable the TETRA . Please find the deployment guide for the best practices on same.  If you wish to run AMP and Windows Defender together you will need to disable the Tetra offline engine   https://www.cisco.com/c/dam/en/us/td/docs/security/sourcefire/fireamp/fireamp-cloud/FireAMPDeploymentStrategy.pdf   Regards Jetsy  ... View more

Hello Joowen1 Please raise a case with TAC and submit the diagnostics in debug mode with the repro of the issue if possible. Regards Jetsy ... View more

Hello Joowen1 What is the existing version of the connectors in use and have you enabled the Exploit prevention in policies ? Regards Jetsy ... View more

Hello    jamoreno   To me this looks like a DNS issue and the IP also doesn't seems to be for  TALOS website.   Regards Jetsy  ... View more

Hello  osw200051   Here are some useful reference for your queries. 1) AMP for end point -  Cisco AMP for Endpoints provides comprehensive protection against the most advanced attacks. It prevents breaches and blocks malware at the point of entry, then rapidly detects, contains, and remediates advanced threats that evade front-line defenses and get inside your network. Basically this can be achieved by installing the connectors in the endpoint workstations. For further info please refer the following.   https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/advanced-malware-protection/at-a-glance-c45-731874.pdf   2)  AMP for network -  Designed for Cisco FirePOWER network security appliances, it provides visibility and control to protect against highly sophisticated, targeted, zero-day, and persistent advanced malware threats.     https://www.cisco.com/c/en/us/products/security/amp-appliances/amp-networks-demonstration.html   3)  AMP with threat-grid - AMP Threat Grid combines static and dynamic malware analysis with threat intelligence into one unified solution.   https://www.cisco.com/c/en_in/solutions/enterprise-networks/amp-threat-grid/index.html   4) What is the role for TALOS on AMP and threat-grid?  AMP is built on an extensive collection of real-time threat intelligence and dynamic malware analytics supplied by Talos, and AMP Threat Grid intelligence feeds .   5. What protection I can achieve when I ordered threat-grid?  Please refer the above links for further info.   Regards Jetsy    ... View more

Hi JDoobs   Are you referring to the Windows Server connector here ? Also the issue description looks like the issue is happening due to lack of exclusions.    Please check the following :-   1) Did you added the required exclusions for the regularly used trusted files and applications ? 2) Is the TETRA and DFC engines were skipped during the installation phase ?   To confirm  exactly what is happening we need the diagnostics files in debug mode so that we can let you know what you should exclude to get rid of the issue.    Regards Jetsy  ... View more