TDR and Cisco AMP

Deployment Overview

Threat Detection and Response is a collection of advanced malware defense tools that correlate threat indicators from Fireboxes and Host Sensors to enable real-time, automated response to stop known, unknown, and evasive threats.

As part of the TDR solution, you install TDR Host Sensors to provide endpoint protection. In some cases, the TDR Host Sensor might have conflicts with the antivirus software installed on your endpoints. To resolve this issue, you can configure exclusions in the antivirus software and in TDR.

This document includes information about the integration of a TDR Host Sensor with a host that runs Cisco AMP software. It does not describe the procedure to set up Threat Detection and Response. For information about how to set up your TDR account, how to enable TDR on a Firebox, and how to install a Host Sensor, see Quick Start — Set Up Threat Detection and Response.

Integration Summary

To avoid conflicts between the TDR Host Sensor and Cisco AMP for Endpoints Connector, add these exclusions:

  • Exclusions in TDR for Cisco AMP — for Windows:
    • C:\Program Files\Cisco\AMP\
    • C:\ProgramData\Cisco\AMP\
  • Exclusions in TDR for Cisco AMP — for Mac:
    • /Library/Application Support/Cisco/AMP for Endpoints Connector/
  • Exclusions in Cisco AMP for the TDR Host Sensor — for Windows:
    • C:\Program Files (x86)\WatchGuard\Threat Detection and Response\
    • C:\Program Files\WatchGuard\Threat Detection and Response\
  • Exclusions in Cisco AMP for the TDR Host Sensor — for Mac:
    • /usr/local/watchguard/
    • /Applications/WatchGuard/

Configuration Details

To complete this deployment, you must have:

  • An active Threat Detection and Response subscription, with Host Sensor licenses
  • Cisco AMP:
    • Cisco AMP for Endpoints Connector 7.0.5.11403 — for Windows
    • Cisco AMP for Endpoints Connector 1.11.1.712 — for Mac

The TDR and Fireware versions tested for this deployment included:

  • TDR Host Sensor 5.8.2.9020
  • Firebox with Fireware 12.5 or higher

The Windows test environment for this deployment included:

  • Windows 7, 8.1, 10 Enterprise 64-bit Operating System
  • Memory (RAM) — 8 GB
  • Processor — 2 CPU Cores

The Mac test environment for this deployment included:

  • macOS 10.13
  • Memory (RAM) — 8 GB
  • Processor — Intel Core i5

Configure Exclusions in TDR

In your TDR account, you can add exclusions to manually identify paths for files and processes that you do not want Host Sensors to monitor. Before you deploy a Host Sensor on computers that have Cisco AMP installed, add exclusions for the Cisco AMP file paths as TDR Exclusions in your TDR account.

In your TDR account, add the TDR exclusions for the paths shown in the Integration Summary.

Unless otherwise noted, configure each TDR exclusion with these options, which are selected by default:

  • Also exclude subfolders
  • Entities to exclude: Files and Processes

To add an exclusion in TDR:

  1. Log in to your TDR account or managed account as a user with Operator privileges.
  2. Select Configuration > Exclusion.
  3. Click Add Exclusion.
    The Add Exclusion dialog box opens.
  4. In the Path text box, type the path to exclude. Folders specified in an exclusion must end with a backslash.
  5. To apply the exception to all hosts, in the Hosts / Groups text box, specify the group All Hosts.
  6. Click Save & Close.

Repeat these steps to add each exclusion.

Configure Exclusions in Cisco AMP

To exclude directories used by the TDR Host Sensor, add the exclusions for the paths listed in the Integration Summary.

To add an exclusion in Cisco AMP for Windows:

  1. Log in to the Cisco AMP web console with your account credentials.
  2. Click Management > Exclusions > Custom Exclusions.
  3. Click + New Exclusion Set, from the New exclusion set for drop-down list, select Windows.
  4. Click Create.
  5. In the Name text box, type a name.
  6. In the text box below, select Path, in the adjacent text box, type the exclusion path.
  7. Click Save.
  8. Click Management > Policies > Windows.
  9. Select a policy, in our example the policy is Protect.
  10. Click Edit, from the Edit Policy section, click Exclusions.
  11. From the Custom Exclusions section, select the exclusion name you just created.
  12. Click Save.

To add an exclusion in Cisco AMP for Mac:

  1. Log in to the Cisco AMP web console with your account credentials.
  2. Click Management > Exclusions > Custom Exclusions.
  3. Click + New Exclusion Set, from the New exclusion set for drop-down list, select Mac.
  4. Click Create.
  5. In the Name text box, type a name.
  6. In the text box below, select Path, in the adjacent text box, type the exclusion path.
  7. Click Save.
  8. Click Management > Policies > Mac.
  9. Select a policy, in our example the policy is Protect.
  10. Click Edit, from the Edit Policy section, click Exclusions.
  11. From the Custom Exclusions section, select the exclusion name you just created.
  12. Click Save.

When you download the installer from the web console, you can select the protect group which is related to the protect policy.

For information about the integration testing methodology, see TDR Testing Methodology.