Now that we have a basic idea of how outbreak control really
works, what is it trying to do in the first place,
and how do we get started with it,
we can now explore some of the other features that
come with outbreak control.
We really get the gist of it, that this
is just what we're permitting or denying within our environment
outside of what also the AMP Cloud is pushing down
to our endpoint.
It's so cool.
I love that we can explore this technology.
Let's check out some of the more advanced features of AMP
for Endpoints Outbreak Control.
So in the previous Nugget, we introduced the simple outbreak WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in the previous Nugget, we introduced the simple outbreak
control mechanism.
There wasn't much to it, right?
We simply upload a file into a new outbreak control
configuration.
And next thing we know, AMP is handling it for us.
But there's other ways that we can control what
goes on in our environment.
It's not necessarily just a hash of a file.
Let's explore the other outbreak control mechanisms
that we can work with here.
If I go back to the Outbreak Control section
and click the little dropdown, we
can see we've got some other options.
We have the Advanced Outbreak Control, as well as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have the Advanced Outbreak Control, as well as
Outbreak Control that are specific to Android devices.
These are tablets and cell phones.
Beyond that, we have applications
that we can explicitly permit or explicitly block.
Now let me explain this.
The applications are the dot exe or executable files.
These aren't going to be like layer five
through layer seven network information.
We're not blocking websites or Netflix or anything like that
here.
We're blocking explicitly executable applications.
But we do have IP addresses that we can block and allow as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But we do have IP addresses that we can block and allow as well.
So again, with all of these items that we configure,
this pushes these informations down to the endpoint devices
once they're associated with a policy.
This is just setting up lists of things to accept or block.
But they don't take effect until we push it down via a policy.
Let's explore something like the blocked
applications for a second.
Here, we can outline more applications
that we want to allow or block.
I like this one here like putty. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I like this one here like putty.
We may only want our network admins
to be able to launch putty.
And everybody else, like end users,
should not be able to launch the putty executable file.
If I click on Edit here, we can see how this works.
Well, it looks just pretty much the exact same way as before,
doesn't it?
Yeah, exactly.
In this case, what we're saying is the applications,
we upload the executable file itself.
It creates the hash of the file right here.
And on our end points where this file WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And on our end points where this file
has been blocked via a policy, if it detects
this hash trying to execute, AMP will stop that from happening.
Some other very cool things that come
from clicking on this little files included here,
we can analyze the file as well as see what kind of trajectory
it takes when it's launched within an environment.
We can actually see, what does it
try to do within the operating system
as well as within the environment itself?
Beyond that, we can add this file
to other items like simple detections, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to other items like simple detections,
allowed applications, or blocked applications.
We can do all of that from right here as well.
See, if I hover over allowed applications,
I can choose to add this file to a different global app
whitelist or so on.
So maybe in my blocked applications,
I have the putty application here.
I want to attach that to my end user policy.
But in the allowed applications, I
may want to put that on my security app whitelist
and push that down to my domain admins.
That's how this works.
Beyond that, Threat Grid and Umbrella,
give us ways that we can view or browse WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
give us ways that we can view or browse
what this program does from a global standpoint.
We can see other analyses using Cisco products of what
this application is doing.
So that's the application controls.
Let's also glance real quick at the IP Block and Allow lists.
If I choose the IP blacklist here,
you can see it's pretty straightforward.
We specify a exact IP address, or we
could specify a CIDR block.
So this could be like 10.10.10.0/24. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this could be like 10.10.10.0/24.
And we can specify what groups of users
or which policies need to have this.
So I see here I have a domain controller policy.
It's got the little Windows symbol here.
And since this is in the IP blacklist,
I assume that my domain controllers cannot access
the host 20.20.20.20.
The flip side of that is I have an IP whitelist.
And I see the CIDR blocks listed here as whitelist.
So my domain controllers would be
able to access these specific IPs or these CIDR notation WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
able to access these specific IPs or these CIDR notation
blocks.
There's that 10.10.10.0/24 I had mentioned earlier.
So the key takeaway here is that outbreak control
comes in many different shapes and sizes.
We can specify a simple outbreak control where we upload a file.
We can do the applications themselves and then
permit or deny applications based on which policy
they're attached to.
And same goes for specific IP addresses or CIDR notated
blocks of IP addresses too.
So that's been using and understanding
all of the outbreak control features.
I hope this has been informative for you, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I hope this has been informative for you,
and I'd like to thank you for viewing.