But if you're buying AMP all by itself, I don't know if it can remove malicious software after the fact or if it requires the other tools that we use to do some of that." "In Orbital, there are tons of prebuilt queries, but there is not a lot of information in lay terms.
We have other tools in place that AMP feeds into that allow for that to happen, so I look at it as one seamless solution. Cisco should understand the need for continuous updates on the custom Cisco exclusions and the custom applications that come out-of-the-box with the AMP for Endpoints." "Maybe there is room for improvement in some of the automated remediation. They continue to innovate in the right way." "I would recommend that the solution offer more availability in terms of the product portfolio and integration with third-party products." "We had a lot of noise at the beginning, and we had to turn it down based on exclusions, application whitelisting, and excluding unknown benign applications.
We think that Cisco covers all of the security aspects on the market. Sometimes, when you're overwhelmed with information, you just say, "I'm not going to look at anything because I'm receiving so much." I recommend the vendor come up with a white paper on the best practices for event notifications." "We don't have issues. I do feel that if you subscribe to all the event notification types out-of-the-box, or don't really go through and take the time to filter out events, the notifications can become overwhelming with information. "The GUI needs improvement, it's not good." "The room for improvement would be on event notifications.
#CHECK POINT VPN SOFTWARE HOW TO#
This helps you understand and nail down what the threat is and how to fix it." Therefore, it gives you great detail, a timeline, and continuity of events leading up to whatever the incident is, and then, after. Then, after the event, something else was launched by whatever the threat was.
For example, you have the event, but you see that the event was launched by Google Chrome, which was launched by something else. You can see what other applications were incorporated into the execution of the threat. You can see what happened after the threat. You can get onto the device trajectory to look at a threat, but you can also see what happened prior to the threat. It allows for research into a threat, and you can chart your progress on how you're resolving it." "The entirety of our network infrastructure is Cisco and the most valuable feature is the integration." "The visibility and insight this solution gives you into threats is pretty granular. And on the scalability side, we can integrate well with the SIEM orchestration engine and a number of applications that are proprietary or open source." "It is extensive in terms of providing visibility and insights into threats. It's one of the best features." "Among the most valuable features are the exclusions. It also has a File Trajectory, so you can even see if that file has been found on any of your other computers that have AMP." "The solution's integration capabilities are excellent. It shows every running process and file access on the computer and saves it like a snapshot when it detects something malicious. It shows the point in time when a virus is downloaded, so you can see if the user was surfing the internet or had a program open. "It is a very stable program." "The threat Grid with the ability to observe the sandboxing, analyze, and perform investigations of different malicious files has been great." "Another of my favorite features is called the Device Trajectory, where it shows everything that's going on, on a computer.
0 kommentar(er)
