Now, arguably, one of the coolest things about Cisco,
especially for us, the learners and the trainers and everybody
out there who wants access to Cisco,
is they let us demo basically every one of their products
for free, whether it's in the DevNet sandbox or the D Cloud.
And AMP for Endpoints is no exception to that rule.
There is a D Cloud environment available for us
to start working with AMP for Endpoints.
So in this particular Nugget and the next couple of Nuggets,
we're actually going to explore AMP for Endpoints configuration
portal, talking about things like the outbreak control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
portal, talking about things like the outbreak control
configurations, as well as setting up policies.
Let's get going with AMP for Endpoints.
I'll see you in there.
So I don't think I can rant and rave about this enough,
how lucky we are that we can access this environment
for free using Cisco's D Cloud.
The link that you can get to access this AMP for Endpoints
is going to be popping up on the screen right now.
So get ready.
We're going to have fun exploring AMP for Endpoints.
As you can see, when we log in right here, what we have is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
As you can see, when we log in right here, what we have is
we have a cool little dashboard that tells us basically
what our threat analytics and our vulnerabilities are.
You see, all of these agents, these AMP agents
are installed on our endpoints.
And they're reporting back to the AMP Cloud right
now about what's going on.
So we can see what users, what compromises exist,
and what vulnerabilities exist, as well as
if any of these threats have been quarantined up
to this point.
If I scroll down here, we can also
see some actual event items that have taken place here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
see some actual event items that have taken place here.
And we can see that one event took place looks
like on September 18th.
And this was the executable file that was triggered
that caused a compromise.
Very cool that we can access this type of information
in a quick snapshot.
But what we're here to do now is we're here
to talk about how we build our own policies for what
we want to control.
And this is done across the top menus
here under Outbreak Control. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here under Outbreak Control.
Outbreak Control is where we define
what it is that we want to permit
and what it is that we want to deny.
If I hover over this and give it a click,
you can see we have some types of things
that we want to permit or deny.
The custom detections are where you're probably
going to be living the most.
Now, keep in mind that files themselves,
AMP is scanning files themselves and looking
for a hash signature of each file.
It reports these back to the AMP Cloud.
And if a hash matches something that it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if a hash matches something that it
knows is a malicious file, it'll report back and perform actions
or quarantine them.
But maybe we encounter a file ourselves
that we want to quarantine or report into AMP as this is not
a good file.
This is what the custom detections are all about.
So maybe somebody sends our end user
an Excel file that has malicious macros built into it.
And AMP doesn't pick it up.
This is where we can report that file in as a malicious macro. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is where we can report that file in as a malicious macro.
And we need to contain it within our environment.
So we're going to do this by looking at the simple custom
detections first of all.
Then in the next Nugget, we'll actually
jump into the rest of these types of outbreak control
configurations once we've got the hang of what this does.
So here's the situation.
I have a little Excel file here that
says execute nuclearvirus.exe.
And this file is called nuclearvirus.xlsx, or whatever
it is that Excel files go by.
This is what I want to report into AMP and say, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is what I want to report into AMP and say,
I don't want this file to exist anywhere within my environment.
So I'm going to report this has into AMP.
And AMP can now scan all of my endpoints for any one
that this file may exist.
So let me close this out real quick.
And what we're going to do is we're
going to create a simple custom detection to detect
files that match that hash.
I'll click Create right here.
And we have to give our detection a name.
I'm going to call this CBT demo or something like that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm going to call this CBT demo or something like that
and click Save.
Now that I see CBT demo has been created,
I'm going to click Edit here to add my file that I want to use.
Now we can do either the SHA-256 hash if we already have it,
or we can upload the file directly
by right here clicking on Upload File
and then browsing to my file.
There it is.
There's nuclearvirus.xlsx right here on top.
I'll click Open.
I'll call this CBT Knox stop new, something like that.
And I'll choose Upload. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'll choose Upload.
When I upload this Excel file into AMP,
it's going to generate the hash of the file itself.
So now I see one file right here has
been associated with CBT demo.
It hasn't been associated with any policies or groups yet.
And that's what we're going to talk about in a later Nugget.
The key thing to keep in mind now
is CBT demo now is a outbreak control mechanism.
This is a custom detection that we can apply to policies.
And when we push this policy down to all of our endpoints, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And when we push this policy down to all of our endpoints,
they'll begin scanning for that exact file
or the hash of that file.
And if there's a match, it will quarantine it.
One of the coolest thing about it
is that even if someone has already
downloaded this file, maybe five days ago,
and executed it, this policy, this little custom detection
can retroactively grab that file and quarantine it.
This isn't only about new downloads or new entrances
into the environment.
This will grab anything historically
that it's detected already on that device. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that it's detected already on that device.
It's really, really cool.
So my end user Bob, who's sitting here on his computer,
may have downloaded nuclearvirus dot Excel file five days ago.
AMP ran through that computer five days ago
and calculated the hash and reported it up
to the AMP Cloud.
Five days later, we've now created this new file
as part of the custom detection and reported it up
to the AMP Cloud.
AMP can now say, oh, thanks for sending me this hash.
Let me look at my database. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let me look at my database.
Wait a minute.
Five days ago, Bob detected that file.
Bob sent us that hash.
We need to go back to Bob's computer
and quarantine that file.
That's what the custom detection can
do for us in the simple method.
This is what AMP for Endpoints is all about,
leveraging this cloud technology.
So that sets up the simple outbreak control.
In the next Nugget, we're going to look
at some of the other outbreak control mechanisms
that we can use.
I hope this has been informative for you,
and I'd like to thank you for viewing.