Endpoint Protection and Detection
Endpoint Protection and Detection (10%) is about Cisco Secure Endpoint (formerly AMP for Endpoints) and how detection, investigation, and response fit together. It is the smallest domain but appears in cross-domain items that combine endpoint telemetry with network visibility and identity.
Architecture and engines
The endpoint connector reports to the cloud console. Detection layers include signature engines (ClamAV, Ethos), exploit prevention, file quarantine, application control, and cloud lookups. File reputation gives an immediate verdict; unknown files are detonated in Secure Malware Analytics (formerly Threat Grid) for behavioral analysis. Exploit prevention targets in-memory techniques that never write a file.
Detection versus response
- EPP prevents known and unknown malware on the host.
- EDR records process, file, and network activity so an analyst can reconstruct an attack chain.
- XDR correlates endpoint, network, email, identity, and cloud telemetry across products.
Investigation tools: file trajectory follows one file's path across hosts; device trajectory shows everything one host did; prevalence shows how rare a file is, a strong signal of targeted malware. Retrospective detection re-evaluates past activity when a verdict changes, so a file judged clean yesterday can generate an alert today. Host isolation cuts the endpoint off from the network except for the console - the containment action, not a permanent fix.
Adjacent components
Cisco Secure Client (formerly AnyConnect) modules: the Umbrella roaming module for DNS enforcement, the posture module reported to ISE, and the network visibility module feeding flow context. Posture assesses OS patch level, antivirus, and disk encryption before granting access.
Worked example
A finance laptop shows an executable with a "clean" verdict from three weeks ago that is now flagged malicious. Reasoning: the verdict changed in the cloud, so retrospective detection fires on the earlier execution. The analyst uses file trajectory to find every host that received the same file, sorts by prevalence to identify the low-prevalence patient-zero host, then isolates affected endpoints and blocks the hash. Device trajectory on the suspected origin confirms the delivery vector.
Traps that cost marks
Assuming the connector alone stops all threats (it does not stop fileless in-memory attacks without exploit prevention); expecting retrospective alerts to auto-quarantine already-delivered files unless configured; confusing Secure Endpoint with a network firewall; and using device trajectory when the question asks about one file across many hosts.