This guide recomends creating an Audit Only, Protect, Triage, Server and Domain Controller policy and the same for groups. It also recomends all the workstations to initially belong to the "Audit Only" group (with the Audit Only policy) and then move them to the Protect group (with Protect policy) after making sure you root out any false positive.
At this point, I downloaded the connector from the "Audit Only Group" with the "Audit Only" policy and installed it in my VM.
Now, I went ahead and moved the computer from the "Audit Only Group" to the "Protect Group" but the Protect Policy is not reflected in the console nor in the connector.
- How do I properly move this Computer from the "Audit Only" to the "Protect" policy?
Doing a "Sync Policy" at the connector only updates any changes done to the "Audit Only" policy.
Rebooting the machine and/or restarting the services don't update the policy.
Cisco Press has published a step-by-step visual guide to configuring and troubleshooting of the Cisco Firepower Threat Defense (FTD). Each consistently organized chapter on this book contains definitions of keywords, operational flowcharts, architectural ...
Monday January 15, 2018
This document outlines compatibility details and product update information of AMP for Endpoints regarding the Microsoft Security Updates and Knowledge Base articles (KB4072699, KB4056892) released on January 3, 2018 to addr...