Configuring Cisco Secure Endpoint and Interpreting Detection Events

What it is

Cisco Secure Endpoint protects devices with a connector, and you manage it from a cloud console using groups and policies.

Configuration decides how the connector detects and what it does with a threat. Events are the alerts and records that it sends back. You need to be able to set up protection and read what an event tells you.

How it works

First organise computers into groups with policies, and then learn to read the events.

Groups and policies

A group is a set of computers, and each group has one policy. Put similar machines in the same group, for example workstations, servers and domain controllers, so that each gets suitable settings. A new connector is installed with a group assigned, and it receives that group's policy.

A policy holds the connector settings. The main areas are:

Modes and detection engines

In a protect style policy, a detected file is quarantined. In an audit style policy, the connector only records the detection, which helps you test before you enforce. Servers and domain controllers normally have their own policies, tuned for performance and for compatibility.

The connector uses several layers of detection.

• Cloud file reputation: a hash lookup that returns a disposition for the file.
• Local engines: signature based scanning that works offline.
• Machine learning and fuzzy matching: catch new variants of known malware.
• Behavioural protection: watches for malicious activity, such as ransomware like encryption.
• Exploit prevention: protects well known processes from exploit techniques.

Exclusions

An exclusion stops scanning of an item, which avoids false positives and performance problems with some business software. Every exclusion is also a hole in your protection, so keep them narrow and documented. Exclude a specific path or process rather than a whole drive.

Custom detections and application control

Outbreak control lets you act faster than the cloud.

• Simple custom detection: blocks a file by its hash.
• Advanced custom detection: uses signature rules.
• Application control: blocks a named application by its hash.
• Network lists: allow or block IP addresses.

File dispositions

The cloud gives every file a disposition. Learn these values.

Reading a detection event

An event is a record of something the connector saw or did. A typical detection event contains these fields, shown here as a simplified illustration of what to look for.

Event type:      Threat Detected
Computer:        LAPTOP-0142
Group:           Workstations
Detection name:  Example.Malware.Name
File name:       invoice.exe
File path:       C:\Users\user\Downloads
SHA-256:         (hash of the file)
Disposition:     Malicious
Action taken:    Quarantine successful
Parent process:  outlook.exe

Read it in order.

• Event type: what kind of event it is.
• Computer and group: where it happened.
• Detection name, hash and disposition: what it is.
• Action: whether it was contained.
• Parent process: how it arrived.

Event types to know

Common event types include threat detected, threat quarantined, quarantine failure, malicious activity protection, exploit prevention and retrospective detection. A quarantine failure is serious, because the threat was not removed. A retrospective detection means that a file was judged malicious after it had been seen as clean.

Investigating with trajectory

Device trajectory shows a timeline of file, process and network activity on one computer. You can see the file arrive, the process that ran it, and the connections that it made. File trajectory shows the same file across all computers, so you can see its spread.

Responding

After you confirm a detection, contain the device, for example by isolating it, and remove or confirm removal of the file. Add a custom detection if needed and scan other devices. If it is a false positive, create a narrow exclusion or an allow list entry, and document why.