Solved: Email security and AMP ( Sourcefire ) integration

Daniel Sandstrom · ‎03-03-2014

Hi,

According to public release from cisco :

http://newsroom.cisco.com/release/1354516/Cisco-Adds-Advanced-Malware-Protection-to-Web-and-Email-Security-Appliances-and-Cloud-Web-Security?utm_medium=rss

There is now integration of AMP into the email and web appliance. I cannot find any information regarding versions or licenses needed to take advantage of this functionality. If customer is sitting on a Sophos license today for example, will AMP be an addon or replacement of this license ?

Any info is appreciated.

rajett · ‎03-03-2014

Hi Daniel,

We announced the software integration at RSA last week. It will be available as a feature in the next 2 to 4 weeks as FCS code (First Customer Ship.) It will be a separate software license for the cloud inspection and a separate license for the cloud sandboxing. It will not be included in any existing licenses. This is the upcoming 8.5.5 version of AsyncOS.

In the mail pipeline it will come after Anti-Spam and Anti-Virus engines and before Content Filters and Outbreak Filters. You will be able to do Content Filter inspections and actions based on AMP results.

Also at RSA we announced the integration of Web Categorization and Web Reputation technology from the WSA into the ESA. This will be included as part of the Outbreak Filters license. Web Reputation is embedded into the anti-spam engine and Outbreak Filters. Web Categorization is available as a condition and as an action in Content Filters. You can do actions such as defang, re-write to Proxy, or replace URL with text or any other Content Filter action such as drop or quarantine messages with Adult or Pornographic category URLs. This is the 8.5.0 version of AsyncOS and is available today as FCS code.

Please work with Cisco TAC to have your devices provisioned for 8.5.0 FCS code if you wish to test.

Thanks,

Raymond Jett

Technical Marketing Engineer

Email Security Products

View solution in original post

rajett · ‎03-03-2014

Hi Daniel,

We announced the software integration at RSA last week. It will be available as a feature in the next 2 to 4 weeks as FCS code (First Customer Ship.) It will be a separate software license for the cloud inspection and a separate license for the cloud sandboxing. It will not be included in any existing licenses. This is the upcoming 8.5.5 version of AsyncOS.

In the mail pipeline it will come after Anti-Spam and Anti-Virus engines and before Content Filters and Outbreak Filters. You will be able to do Content Filter inspections and actions based on AMP results.

Also at RSA we announced the integration of Web Categorization and Web Reputation technology from the WSA into the ESA. This will be included as part of the Outbreak Filters license. Web Reputation is embedded into the anti-spam engine and Outbreak Filters. Web Categorization is available as a condition and as an action in Content Filters. You can do actions such as defang, re-write to Proxy, or replace URL with text or any other Content Filter action such as drop or quarantine messages with Adult or Pornographic category URLs. This is the 8.5.0 version of AsyncOS and is available today as FCS code.

Please work with Cisco TAC to have your devices provisioned for 8.5.0 FCS code if you wish to test.

Thanks,

Raymond Jett

Technical Marketing Engineer

Email Security Products

Daniel Sandstrom · ‎03-03-2014

Thanks for the update . I'll keep my eyes open for the upcoming releases then.