How Does Cisco Secure Endpoint / AMP Work?

preview_player
Показать описание
A short video explaining how Secure Endpoint works (previously known as AMP).
A little bit of stutter as I try to explain this technology to my manager! But hey made it to the end.
Рекомендации по теме
Комментарии
Автор

Some additional detail RE the operation of the AMP cloud, once the connector is installed on the endpoint : when a file is moved, copied or executed a SHA-256 hash is calculated and sent to this AMP cloud for the file verdict. If the file is unknown & the AMP connector is configured to send the whole file to AMP cloud, it will also send it to TG for analysis as you saw in the video.

CyberTronics
Автор

ThreatGrid: when TG updates verdict in AMP cloud, the AMP cloud component informs all components that have seen the file previously through the retrospective event. So if you are a user or AMP, you are inadvertently helping anyone else who uses AMP!

CyberTronics