Secure Endpoint Integration

What it is

Secure Endpoint is Cisco endpoint protection, and the integration joins what the endpoint sees with what the firewall sees.

The firewall inspects files as they cross the network. The endpoint agent watches files and processes on the host itself. Together they give a fuller picture of malware, because each can see what the other cannot.

The link is made through the Cisco cloud, which holds the file verdicts and the endpoint events.

How it works

The Secure Firewall Management Center (FMC) connects to the cloud, and the cloud connects the two products.

The cloud connection

The FMC has a cloud connection page for the Cisco malware cloud, and you choose the cloud region that matches your account. The FMC then registers with the cloud.

You usually sign in to the Secure Endpoint console during that step to approve the connection. After that, the FMC can both look up file verdicts and receive endpoint information.

The same cloud connection is used by the file policy lookups described in the Malware Defense page, so one setup helps both features.

What the integration shares

The connection provides several benefits.

• Endpoint events in the FMC. Malware and other threat events that the endpoint agent reports can appear in the FMC along with the network events.
• Indications of compromise. A host with endpoint detections can be flagged in the network map, so you can find the infected hosts quickly.
• Shared verdicts. The firewall and the endpoint use file verdicts from the same cloud, so a file known to be bad can be recognised in both places.
• Trajectory. For a file, you can follow where it travelled between hosts, which helps you scope an outbreak.

Which events and fields are available depends on the release and on the cloud services you use, so check the current documentation for your versions.

Custom detections

You can maintain a list of files that you always want to treat as bad. Endpoint and firewall features can use lists of this kind, so that one decision applies in more than one place. Keep the lists tidy, because a wrong entry blocks a legitimate file.

Deploying and checking

Set up the cloud connection, enable the features in the file policy and in the integration area, and deploy. Then check the events pages.

Look in the file and malware events of the FMC for items from the endpoint source. Look at the network map for hosts with an indication of compromise.

Why use both

The firewall protects every device behind it, including those with no agent. The endpoint agent protects the device wherever it goes, even away from the corporate network, and sees the process that opened the file.

The two sources give you a stronger answer to the questions that matter in an incident. These are which host is affected, which file is involved and where it has moved.

Licences and access

The integration needs the right licences on both sides. It also needs the FMC to reach the cloud over the internet, so check filtering on the management path.