WEBVTT

1
00:00.000 --> 00:00.060 align:middle line:84%


2
00:00.060 --> 00:02.700 align:middle line:90%
Now, arguably, one of the
coolest things about Cisco,

3
00:02.700 --> 00:06.300 align:middle line:90%
especially for us, the learners
and the trainers and everybody

4
00:06.300 --> 00:08.760 align:middle line:90%
out there who wants
access to Cisco,

5
00:08.760 --> 00:11.700 align:middle line:90%
is they let us demo basically
every one of their products

6
00:11.700 --> 00:15.060 align:middle line:90%
for free, whether it's in the
DevNet sandbox or the D Cloud.

7
00:15.060 --> 00:18.180 align:middle line:90%
And AMP for Endpoints is
no exception to that rule.

8
00:18.180 --> 00:20.880 align:middle line:90%
There is a D Cloud
environment available for us

9
00:20.880 --> 00:23.060 align:middle line:90%
to start working with
AMP for Endpoints.

10
00:23.060 --> 00:25.560 align:middle line:90%
So in this particular Nugget
and the next couple of Nuggets,

11
00:25.560 --> 00:29.370 align:middle line:90%
we're actually going to explore
AMP for Endpoints configuration

12
00:29.370 --> 00:32.520 align:middle line:90%
portal, talking about things
like the outbreak control
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.370 --> 00:32.520 align:middle line:90%
portal, talking about things
like the outbreak control

13
00:32.520 --> 00:35.430 align:middle line:90%
configurations, as well
as setting up policies.

14
00:35.430 --> 00:37.660 align:middle line:90%
Let's get going with
AMP for Endpoints.

15
00:37.660 --> 00:39.070 align:middle line:84%
I'll see you in there.

16
00:39.070 --> 00:41.430 align:middle line:90%
So I don't think I can rant
and rave about this enough,

17
00:41.430 --> 00:44.850 align:middle line:90%
how lucky we are that we
can access this environment

18
00:44.850 --> 00:47.430 align:middle line:84%
for free using Cisco's D Cloud.

19
00:47.430 --> 00:50.910 align:middle line:90%
The link that you can get to
access this AMP for Endpoints

20
00:50.910 --> 00:53.350 align:middle line:90%
is going to be popping up
on the screen right now.

21
00:53.350 --> 00:54.180 align:middle line:84%
So get ready.

22
00:54.180 --> 00:57.090 align:middle line:90%
We're going to have fun
exploring AMP for Endpoints.

23
00:57.090 --> 01:00.210 align:middle line:90%
As you can see, when we log
in right here, what we have is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:57.090 --> 01:00.210 align:middle line:90%
As you can see, when we log
in right here, what we have is

24
01:00.210 --> 01:03.630 align:middle line:90%
we have a cool little dashboard
that tells us basically

25
01:03.630 --> 01:06.930 align:middle line:90%
what our threat analytics
and our vulnerabilities are.

26
01:06.930 --> 01:10.050 align:middle line:90%
You see, all of these
agents, these AMP agents

27
01:10.050 --> 01:12.330 align:middle line:84%
are installed on our endpoints.

28
01:12.330 --> 01:15.960 align:middle line:90%
And they're reporting back
to the AMP Cloud right

29
01:15.960 --> 01:17.620 align:middle line:84%
now about what's going on.

30
01:17.620 --> 01:20.970 align:middle line:90%
So we can see what users,
what compromises exist,

31
01:20.970 --> 01:23.490 align:middle line:90%
and what vulnerabilities
exist, as well as

32
01:23.490 --> 01:26.310 align:middle line:90%
if any of these threats
have been quarantined up

33
01:26.310 --> 01:27.360 align:middle line:84%
to this point.

34
01:27.360 --> 01:29.670 align:middle line:90%
If I scroll down
here, we can also

35
01:29.670 --> 01:33.480 align:middle line:90%
see some actual event items
that have taken place here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:29.670 --> 01:33.480 align:middle line:90%
see some actual event items
that have taken place here.

36
01:33.480 --> 01:36.180 align:middle line:90%
And we can see that one
event took place looks

37
01:36.180 --> 01:37.920 align:middle line:84%
like on September 18th.

38
01:37.920 --> 01:41.760 align:middle line:90%
And this was the executable
file that was triggered

39
01:41.760 --> 01:43.500 align:middle line:84%
that caused a compromise.

40
01:43.500 --> 01:46.590 align:middle line:90%
Very cool that we can access
this type of information

41
01:46.590 --> 01:48.240 align:middle line:84%
in a quick snapshot.

42
01:48.240 --> 01:50.280 align:middle line:90%
But what we're here to
do now is we're here

43
01:50.280 --> 01:54.630 align:middle line:90%
to talk about how we build
our own policies for what

44
01:54.630 --> 01:56.230 align:middle line:84%
we want to control.

45
01:56.230 --> 01:58.380 align:middle line:90%
And this is done
across the top menus

46
01:58.380 --> 02:00.450 align:middle line:84%
here under Outbreak Control.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:58.380 --> 02:00.450 align:middle line:84%
here under Outbreak Control.

47
02:00.450 --> 02:02.730 align:middle line:90%
Outbreak Control
is where we define

48
02:02.730 --> 02:04.440 align:middle line:90%
what it is that
we want to permit

49
02:04.440 --> 02:06.660 align:middle line:90%
and what it is that
we want to deny.

50
02:06.660 --> 02:08.820 align:middle line:90%
If I hover over this
and give it a click,

51
02:08.820 --> 02:11.370 align:middle line:90%
you can see we have
some types of things

52
02:11.370 --> 02:13.200 align:middle line:84%
that we want to permit or deny.

53
02:13.200 --> 02:15.750 align:middle line:90%
The custom detections
are where you're probably

54
02:15.750 --> 02:17.370 align:middle line:84%
going to be living the most.

55
02:17.370 --> 02:20.040 align:middle line:90%
Now, keep in mind
that files themselves,

56
02:20.040 --> 02:22.410 align:middle line:90%
AMP is scanning files
themselves and looking

57
02:22.410 --> 02:26.370 align:middle line:90%
for a hash signature
of each file.

58
02:26.370 --> 02:28.830 align:middle line:90%
It reports these back
to the AMP Cloud.

59
02:28.830 --> 02:31.260 align:middle line:90%
And if a hash matches
something that it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:28.830 --> 02:31.260 align:middle line:90%
And if a hash matches
something that it

60
02:31.260 --> 02:35.700 align:middle line:90%
knows is a malicious file, it'll
report back and perform actions

61
02:35.700 --> 02:36.660 align:middle line:84%
or quarantine them.

62
02:36.660 --> 02:40.110 align:middle line:90%
But maybe we encounter
a file ourselves

63
02:40.110 --> 02:43.770 align:middle line:90%
that we want to quarantine or
report into AMP as this is not

64
02:43.770 --> 02:44.920 align:middle line:84%
a good file.

65
02:44.920 --> 02:48.280 align:middle line:90%
This is what the custom
detections are all about.

66
02:48.280 --> 02:50.340 align:middle line:90%
So maybe somebody
sends our end user

67
02:50.340 --> 02:54.870 align:middle line:90%
an Excel file that has
malicious macros built into it.

68
02:54.870 --> 02:56.850 align:middle line:84%
And AMP doesn't pick it up.

69
02:56.850 --> 03:01.500 align:middle line:90%
This is where we can report that
file in as a malicious macro.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:56.850 --> 03:01.500 align:middle line:90%
This is where we can report that
file in as a malicious macro.

70
03:01.500 --> 03:04.390 align:middle line:90%
And we need to contain it
within our environment.

71
03:04.390 --> 03:07.170 align:middle line:90%
So we're going to do this by
looking at the simple custom

72
03:07.170 --> 03:08.515 align:middle line:84%
detections first of all.

73
03:08.515 --> 03:10.140 align:middle line:90%
Then in the next
Nugget, we'll actually

74
03:10.140 --> 03:13.200 align:middle line:90%
jump into the rest of these
types of outbreak control

75
03:13.200 --> 03:17.500 align:middle line:90%
configurations once we've got
the hang of what this does.

76
03:17.500 --> 03:18.690 align:middle line:84%
So here's the situation.

77
03:18.690 --> 03:21.090 align:middle line:90%
I have a little
Excel file here that

78
03:21.090 --> 03:23.430 align:middle line:84%
says execute nuclearvirus.exe.

79
03:23.430 --> 03:27.690 align:middle line:90%
And this file is called
nuclearvirus.xlsx, or whatever

80
03:27.690 --> 03:29.250 align:middle line:84%
it is that Excel files go by.

81
03:29.250 --> 03:32.350 align:middle line:90%
This is what I want to
report into AMP and say,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:29.250 --> 03:32.350 align:middle line:90%
This is what I want to
report into AMP and say,

82
03:32.350 --> 03:37.420 align:middle line:90%
I don't want this file to exist
anywhere within my environment.

83
03:37.420 --> 03:39.960 align:middle line:90%
So I'm going to report
this has into AMP.

84
03:39.960 --> 03:43.620 align:middle line:90%
And AMP can now scan all
of my endpoints for any one

85
03:43.620 --> 03:45.190 align:middle line:84%
that this file may exist.

86
03:45.190 --> 03:46.960 align:middle line:90%
So let me close
this out real quick.

87
03:46.960 --> 03:48.418 align:middle line:90%
And what we're
going to do is we're

88
03:48.418 --> 03:51.570 align:middle line:90%
going to create a simple
custom detection to detect

89
03:51.570 --> 03:53.440 align:middle line:84%
files that match that hash.

90
03:53.440 --> 03:55.110 align:middle line:84%
I'll click Create right here.

91
03:55.110 --> 03:57.460 align:middle line:90%
And we have to give
our detection a name.

92
03:57.460 --> 04:00.030 align:middle line:90%
I'm going to call this CBT
demo or something like that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:57.460 --> 04:00.030 align:middle line:90%
I'm going to call this CBT
demo or something like that

93
04:00.030 --> 04:01.140 align:middle line:84%
and click Save.

94
04:01.140 --> 04:03.900 align:middle line:90%
Now that I see CBT
demo has been created,

95
04:03.900 --> 04:07.990 align:middle line:90%
I'm going to click Edit here to
add my file that I want to use.

96
04:07.990 --> 04:12.720 align:middle line:90%
Now we can do either the SHA-256
hash if we already have it,

97
04:12.720 --> 04:14.850 align:middle line:90%
or we can upload
the file directly

98
04:14.850 --> 04:17.010 align:middle line:90%
by right here clicking
on Upload File

99
04:17.010 --> 04:18.850 align:middle line:84%
and then browsing to my file.

100
04:18.850 --> 04:19.390 align:middle line:84%
There it is.

101
04:19.390 --> 04:22.530 align:middle line:90%
There's nuclearvirus.xlsx
right here on top.

102
04:22.530 --> 04:23.670 align:middle line:84%
I'll click Open.

103
04:23.670 --> 04:28.720 align:middle line:90%
I'll call this CBT Knox stop
new, something like that.

104
04:28.720 --> 04:30.180 align:middle line:84%
And I'll choose Upload.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
04:28.720 --> 04:30.180 align:middle line:84%
And I'll choose Upload.

105
04:30.180 --> 04:32.940 align:middle line:90%
When I upload this
Excel file into AMP,

106
04:32.940 --> 04:36.790 align:middle line:90%
it's going to generate the
hash of the file itself.

107
04:36.790 --> 04:39.450 align:middle line:90%
So now I see one
file right here has

108
04:39.450 --> 04:41.490 align:middle line:84%
been associated with CBT demo.

109
04:41.490 --> 04:44.370 align:middle line:90%
It hasn't been associated with
any policies or groups yet.

110
04:44.370 --> 04:46.950 align:middle line:90%
And that's what we're going to
talk about in a later Nugget.

111
04:46.950 --> 04:48.570 align:middle line:90%
The key thing to
keep in mind now

112
04:48.570 --> 04:53.730 align:middle line:90%
is CBT demo now is a
outbreak control mechanism.

113
04:53.730 --> 04:57.870 align:middle line:90%
This is a custom detection
that we can apply to policies.

114
04:57.870 --> 05:00.830 align:middle line:90%
And when we push this policy
down to all of our endpoints,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:57.870 --> 05:00.830 align:middle line:90%
And when we push this policy
down to all of our endpoints,

115
05:00.830 --> 05:03.350 align:middle line:90%
they'll begin scanning
for that exact file

116
05:03.350 --> 05:04.860 align:middle line:84%
or the hash of that file.

117
05:04.860 --> 05:07.400 align:middle line:90%
And if there's a match,
it will quarantine it.

118
05:07.400 --> 05:08.870 align:middle line:90%
One of the coolest
thing about it

119
05:08.870 --> 05:10.850 align:middle line:90%
is that even if
someone has already

120
05:10.850 --> 05:12.770 align:middle line:90%
downloaded this file,
maybe five days ago,

121
05:12.770 --> 05:17.300 align:middle line:90%
and executed it, this policy,
this little custom detection

122
05:17.300 --> 05:21.680 align:middle line:90%
can retroactively grab that
file and quarantine it.

123
05:21.680 --> 05:25.760 align:middle line:90%
This isn't only about new
downloads or new entrances

124
05:25.760 --> 05:27.030 align:middle line:84%
into the environment.

125
05:27.030 --> 05:29.240 align:middle line:90%
This will grab
anything historically

126
05:29.240 --> 05:31.850 align:middle line:90%
that it's detected
already on that device.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
05:29.240 --> 05:31.850 align:middle line:90%
that it's detected
already on that device.

127
05:31.850 --> 05:33.240 align:middle line:84%
It's really, really cool.

128
05:33.240 --> 05:36.650 align:middle line:90%
So my end user Bob, who's
sitting here on his computer,

129
05:36.650 --> 05:40.790 align:middle line:90%
may have downloaded nuclearvirus
dot Excel file five days ago.

130
05:40.790 --> 05:44.360 align:middle line:90%
AMP ran through that
computer five days ago

131
05:44.360 --> 05:47.150 align:middle line:90%
and calculated the
hash and reported it up

132
05:47.150 --> 05:48.470 align:middle line:84%
to the AMP Cloud.

133
05:48.470 --> 05:51.440 align:middle line:90%
Five days later, we've
now created this new file

134
05:51.440 --> 05:53.720 align:middle line:90%
as part of the custom
detection and reported it up

135
05:53.720 --> 05:54.740 align:middle line:84%
to the AMP Cloud.

136
05:54.740 --> 05:58.610 align:middle line:90%
AMP can now say, oh, thanks
for sending me this hash.

137
05:58.610 --> 06:00.050 align:middle line:84%
Let me look at my database.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
05:58.610 --> 06:00.050 align:middle line:84%
Let me look at my database.

138
06:00.050 --> 06:00.710 align:middle line:84%
Wait a minute.

139
06:00.710 --> 06:03.620 align:middle line:90%
Five days ago, Bob
detected that file.

140
06:03.620 --> 06:05.150 align:middle line:84%
Bob sent us that hash.

141
06:05.150 --> 06:07.160 align:middle line:90%
We need to go back
to Bob's computer

142
06:07.160 --> 06:08.840 align:middle line:84%
and quarantine that file.

143
06:08.840 --> 06:11.090 align:middle line:90%
That's what the
custom detection can

144
06:11.090 --> 06:13.100 align:middle line:84%
do for us in the simple method.

145
06:13.100 --> 06:15.830 align:middle line:90%
This is what AMP for
Endpoints is all about,

146
06:15.830 --> 06:18.330 align:middle line:90%
leveraging this
cloud technology.

147
06:18.330 --> 06:20.475 align:middle line:90%
So that sets up the
simple outbreak control.

148
06:20.475 --> 06:22.100 align:middle line:90%
In the next Nugget,
we're going to look

149
06:22.100 --> 06:24.500 align:middle line:90%
at some of the other
outbreak control mechanisms

150
06:24.500 --> 06:25.550 align:middle line:84%
that we can use.

151
06:25.550 --> 06:27.290 align:middle line:90%
I hope this has been
informative for you,

152
06:27.290 --> 06:30.010 align:middle line:90%
and I'd like to thank
you for viewing.