Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Policy and Group change in AMP for Endpoints

I deployed AMP for endpoint to a test machine following Cisco's Deployment Strategy guide for AMP for endpoint.

 

This guide recomends creating an Audit Only, Protect, Triage, Server and Domain Controller policy and the same for groups. It also recomends all the workstations to initially belong to the "Audit Only" group (with the Audit Only policy) and then move them to the Protect group (with Protect policy) after making sure you root out any false positive. 

 

At this point, I downloaded the connector from the "Audit Only Group" with the "Audit Only" policy and installed it in my VM.

 

connector down.png

 

CiscoAMP Connector.png

 

Now, I went ahead and moved the computer from the "Audit Only Group" to the "Protect Group" but the Protect Policy is not reflected in the console nor in the connector.

 

PGroup.png

 

- How do I properly move this Computer from the "Audit Only" to the "Protect" policy?

Doing a "Sync Policy" at the connector only updates any changes done to the "Audit Only" policy.

Rebooting the machine and/or restarting the services don't update the policy.

4 REPLIES
Highlighted
Community Member

Re: Policy and Group change in AMP for Endpoints

It looks like ~24h after the changes. The client and the console updated automatically.

 

ProConsole.pngProPolicy.png

 

 

Checking at the console events, the agent fecthed the policies on 01/10 and 01/11 but only the one from today (01/11) made the change. 

 

Events.png

Cisco Employee

Re: Policy and Group change in AMP for Endpoints

Hi

 

every agent checks periodically based on a heartbeat interval against cloud.

This time is specified per policy, as you see it in the screenshot.

Regards

David

Community Member

Re: Policy and Group change in AMP for Endpoints

David,

 

Does this mean that changing a computer from one policy to another occurs when a heartbeat happens? If so, is there any way to force a computer to change to the new policy?

 

Thanks,
Garrett

Cisco Employee

Re: Policy and Group change in AMP for Endpoints

Hello Garrett

 

If you make any kind of changes in the policy including changing the connectors from one group to another , it will take effect only after the heartbeat interval . You can set the heartbeat interval starting from 15 minutes. 

 

Regards

Jetsy 

979
Views
0
Helpful
4
Replies
CreatePlease to create content