Endpoint Protection and Detection
Concepts to know
Cisco Secure Endpoint (formerly AMP for Endpoints) combines cloud reputation, file analysis, exploit prevention, behavioral protection, and endpoint detection and response (EDR). Know the connector, policies, exclusions, offline versus online states, quarantine, device control, and isolation. Files with unknown verdicts can be sent to Cisco Threat Grid for sandboxing; retrospective detection alerts when a previously clean file becomes malicious. EDR telemetry feeds investigation and response, while XDR correlates across email, web, endpoint, and identity.
Traps
- Reputation lookup and sandboxing are different actions; a file can be allowed initially and flagged retrospectively.
- Exclusions apply to scans and policies, not to every protection; over-broad exclusions create blind spots.
- Isolation blocks network access but preserves the endpoint for investigation-do not confuse it with quarantine.
- Offline endpoints use cached policy and cannot get real-time verdicts.
- Detection is not prevention: a detection-only policy will not block the file.
Worked example
A user downloads an unknown executable. The connector computes a SHA-256, checks the cloud, gets an unknown verdict, and submits the file to sandboxing. If the later verdict is malicious, a retrospective alert fires and the file is quarantined per policy. Rule of thumb: reputation first, sandbox second, retrospective response third.