Swiss knife for a safe workplace

Cisco Secure Endpoint Software at a Glance

Probably almost everyone knows what a swiss knife is. This is such a useful thing that will help a person do many things that cannot be done with bare hands. You don’t need to carry a whole suitcase of tools with you.

This kind of multitool is a workplace security toolkit offered by Cisco – Secure Endpoint.

First, the workplace provides additional capabilities: powerful EDR, built-in XDR and Secure-X Threat Hunting functionality, and simplified incident investigations.

Secondly, an impressive list of main components (overview):

Connectors:

• WINDOWS (11 connectors, including ClamAV (Advanced Custom Detections); Malicious Activity Protection; Behavioral Protection; SHA256 1:1, etc.)
• OSX (4 connectors, including ClamAV (OSX Signatures); SHA256 1:1, etc.)
• Linux (4 connectors, including ClamAV (Full Signatures); SHA256 1:1, etc.)
• Android (4 connectors, including Retrospective Detections; SHA256 1:1, etc.)
• iOS (4 connectors, including Network forensics; IP blocking, etc.)

Protection Engine:

• Basic Endpoint Protection:
  • Offline (Ransomware; File scan; Exploit prevention; Script protection; Behavioral).
  • Online (Machine Learning; Malware Grouping).
  • Endpoint Backend (Detection IOA / IOC; File repository; Malware Analytics).
• Advanced Protection:
  • Search for known threats;
  • Search for signatures;
  • Search for encryption;
  • Review of file hashes;
  • Search for polymorphs;
  • Blocking malicious software;
  • Engine for blocking ransomware;
  • Protection of system processes;
  • Network protection (extended Global Treaty Alert).

Control of devices connected to the workplace (Device Control) Managing USB Devices.

Upgrade Options Upgrade via console; Update via Installer.

Built into Cisco Secure Client Secure Endpoint is one of the options of Cisco Secure Client.

One agent for SASE, XDR and Zero Trust.

Events: Messages; Access to cloud IoC.

Automated Actions: Snapshot; Isolation of the workplace; Uploading a file to Malware Analytics; Transfer to group; Journaling.

Indicators of Compromise (IoC) (communication with Cisco Analyst and Talos): Endpoint IOC; Cloud IOC.

Exclusions Control – the ability to create a list of objects for which planned actions are not performed or are performed in a simplified form.

Managing network settings (Network Settings) – configuration of rules and policies for the proxy and firewall.

Orbital’s advanced search functionality is a service that uses a database to enable your applications to obtain information about your hosts, making it easier to find threats and investigate incidents.

Secure Endpoint software is deployed in a public (with a connector) or private (as a virtual or physical device) cloud. It has a single console that allows you to manage all installations from one place. Control:

• control of attacks, networks and applications, preservation of functioning;
• end point (workstation);
• fixing the trajectories of a device or file;
• analysis of files, distributions and vulnerable software.

As you can see, this is truly a kind of «swiss knife» with many different blades among Cisco products, created for information security architecture solutions from this vendor.

Want more details? Contact AM Integrator Group specialists – and we will organize a presentation, technical session, demonstration.