エンジニアがカスタム検出ポリシーをCiscoAMP展開に追加し、設定で問題が発生しました。単純な検出メカニズムが構成されていますが、ダッシュボードはハッシュが64文字ではなく、ゼロ以外であることを示しています。問題は何ですか?
正解:A
The issue is that the engineer is using the wrong hashing algorithm to generate the hash for the custom detection policy. Cisco AMP for Endpoints requires the use of SHA-256 hashes for simple custom detections, as stated in the Configure a Simple Custom Detection List on the AMP for Endpoints Portal document. SHA-
256 hashes are 64 hexadecimal characters long, while MD5 hashes are 32 hexadecimal characters long.
Therefore, if the engineer tries to upload a hash created using MD5, the dashboard will indicate that the hash is not 64 characters and is non-zero, as shown in the image below:
To resolve the issue, the engineer should use a tool or a website that can generate SHA-256 hashes from files, such as this one, and upload the correct hash to the custom detection list. References : Configure a Simple Custom Detection List on the AMP for Endpoints Portal, Create an Advanced Custom Detection List in Cisco Secure Endpoint, Working with Advanced Malware Protection (AMP) for Endpoints