AMP4EP

Question 1

File Fetch

Answer 1

is used to extract the files so that they can be analyzed by ThreatGrid

Question 2

Application Interface (API)

Answer 2

The API is a set of programmatic interfaces that allow you to access the data and events in your account without logging into the Console.

Question 3

Cognitive Threat Analytics (CTA)

Answer 3

Records any incidents that occur on computers that don’t have an AMP for Endpoints connector installed.
* Detects/Records breaches by analyzing web traffic from all devices on the network even if they don’t have AMP4EP connector on the device.

Question 4

Auto Analysis for Low Prevalence

Answer 4

Finds rare executables (.exe) that are only on a few machines and submit to TALOS if they look suspicious
* Can submit up to 80 auto and 20 manual (files) per day

Question 5

Simple Custom Detection List

Answer 5

is similar to a blacklist. These are files that you want to detect and quarantine.
* Not only will SCDL quarantine future files, but through Cloud Recall, it will quarantine instances of the file on any EP in your organization that the service has already seen it on.

Question 6

Advanced Custom Detection List

Answer 6

are like traditional antivirus signatures, but they are written by the user. These signatures can inspect various aspects of a file and have different signature formats

Question 7

Exclusion List

Answer 7

is a director, file extension, or threat name that you do not want the AMP for EP connector to scan or convict.
* Exclusions can be used to resolve conflicts with other security products or mitigate performance issues by excluding directories containing large files that are written to frequently like databases.

Question 8

Device Trajectory

Answer 8

Shows activity on computers that have deployed the AMP for Endpoints Connector. It continuously tracks activity and communications on devices and on the system level. This helps you quickly understand root causes and the chronological history of events leading up to and after compromise.

Question 9

File Trajectory

Answer 9

Shows the complete lifecycle of each file in your environment from the first time it was seen to the last time, as well as all computers in the network that were affected. So, you can get better visibility and reduce the time required to scope a malware breach.

Question 10

Blacklisting

Answer 10

Blocking access to particular known threats or vulnerabilities but also those that are deemed inappropriate within a given organization

Question 11

Cloud Access Security Broker

Answer 11

Acts as a gatekeeper, allowing the organization to extend the reach of their security policies beyond their own infrastructure.

Question 12

Command and Control Callbacks

Answer 12

Centralized machines that are able to send commands and receive outputs of machines (part of a botnet). They have the ability to leak data and can be hard to identify on an endpoint.

Question 13

DNS (Domain Name System)

Answer 13

Naming system for computers, services, or other resources connected to the Internet or a private network. It’s responsible for the translation of domain name to their respective IP addresses.

Question 14

IPS

Answer 14

Intrusion Protection System (essentially the “Alarm System” for your network)

Question 15

Lightweight connector

Answer 15

Means that there is minimal/negligible impact on performance (such as CPU usage).

Question 16

Micro-applications

Answer 16

Small applications (or sub applications of a larger service) designed to extend a defined set of enterprise functionality and transactions that is specific to a user’s role and requirements. (i.e. Chat, send documents).

Question 17

Multi-layered Approach

Answer 17

A defensive strategy featuring multiple defensive layers that are designed to slow down an attacker

Question 18

Point in Time

Answer 18

Incoming files will be scanned only once

Question 19

Sandboxing

Answer 19

Security mechanism for separating running programs. It is often used to test untrusted programs or code.

Question 20

Shadow IT

Answer 20

Systems and solutions built and used inside organizations without explicit organizational approval

Question 21

Software defined segmentation

Answer 21

Segmenting which applications can “talk” to users, other applications, and to the public internet. Determines what/who can access data across your network, while examining your access (who you are and if you have the permissions to access the data).

Question 22

TALOS

Answer 22

The industry-leading threat intelligence organization dedicated to providing protection before, during, and after cybersecurity attacks.

Question 23

Virtual Private Network

Answer 23

Encryption that provides secure access to a remote computer over the Internet.

Question 24

Zero Day Attacks

Answer 24

A zero-day (also known as zero-hour or 0-day or day zero) vulnerability is an undisclosed computer-software vulnerability that hackers can exploit to adversely affect computer programs, data, additional computers or a network before there is a patch or fix for remediation.