Cisco Secure Endpoint
Cisco Secure Endpoint is an endpoint security solution provided by Cisco Systems. It is designed to protect endpoint devices such as laptops, desktops, servers, and mobile devices from security threats such as malware, ransomware, and zero-day attacks
Secure Endpoint Cloud Portal
First we’ll configure everything on the Cloud Portal
Exclusions
First create new sets of exclusion lists for Windows Client
Here the Endpoint Devices happen to use BigFix software so we’d want to exclude its paths
Next create another list for Windows Server
Outbreak Control - Custom Detection
On Outbreak Control, select Simple Custom Detection
And then create a new list named “Quarantine List”
Outbreak Control - Application Control
Blocked Application
Here create a new list of blocked application named “App Block List”
Allowed Application
And also create a new list of allowed application named “App Allow List”
Policies
Modes and Engines
First we’ll create a new policy for Windows Endpoint with the mode set to Debug
Exclusions
On here Select the Cisco-maintained exclusions as needed and on Custom Exclusions user the one created earlier
Outbreak Control
On here select the Outbreak Control sets that was created earlier
Administrative Features
And lastly configure the log level to be debug and hit save
Next create a new policy for Windows Server, we want to disable the Network Monitoring for servers, other than that keep everything the same
And lastly for Linux Server
Now we end up with these 3 policies
Groups
Create a new group for Client Endpoints using the Windows Policy that has juts been created
Then another policy for Windows and Linux servers
Here’s the 2 groups we end up with
Installing CSE Connector
Windows Client
On Download Page, select the Client Group download the Connector
On the Windows Client, install the connector
Now the Secure Endpoint Connector is installed
Now going back to the CSE Portal, on Management » Computers we’ll see the installed machine shows up here
Windows Server
Download the Connector for Windows Server
On the windows server, run this command to install it
Now the Secure Endpoint Connector is installed
Linux Server
Download the Connector for Linux Server, or Copy the URL
Download the .rpm installer on CentOS with “wget”
Run “yum local install amp.rpm -y” to execute the installer
Run “/opt/cisco/amp/bin/ampcli status” to see the Secure Endpoint installation status
And now back on the CSE Portal, we have 3 computers here
Events
On Events, we can see all the events picked up by the CSE Connector on that particular computer
And now we’ll try running activies on this machine, such as creating words documents or installing steam
On that Computer’s Device Trajectory, we can see these activies being monitored to a great details
