Security · Secure Endpoint (AMP)
Plan a clean Cisco Secure Endpoint rollout — connector packaging per OS, policy groups, SecureX / XDR integration, and the exclusion list that prevents CPU complaints from devs and Finance.
Secure Endpoint (ex-AMP4E) is excellent, but in default mode it can spike CPU on dev laptops compiling code, and it sometimes eats into SQL Server I/O. The trick is policy groups per OU plus well-chosen exclusions. This planner lays it all out.
Output includes: policy groups to create, pilot/production wave plan, connector download link sources, recommended exclusions, and the XDR integration steps. The exclusion list uses Cisco's published safe-lists plus additions from SQL Server, Intune agents, and dev IDEs.
Default policy groups: Servers (audit mode for a week), Workstations — Standard, Workstations — Developers (looser exclusions, Orbital enabled), Workstations — Executive (higher detail logging), Linux (servers). File scan is CPU-light in 8.x connectors, but ETW-based detections for macro/PowerShell are the real value — keep them on in all groups.
SecureX is being sunsetted in favor of Cisco XDR. If starting fresh, integrate directly with XDR: device trajectory + file trajectory + process lineage in one timeline.
Yes — Secure Endpoint pairs with Defender. Disable other 3rd-party AV first to avoid conflicts.
If you have a threat-hunting SOC — yes. Orbital osquery queries are a power feature. If not, you can skip and enable later.
4 policy groups. Wave 1: IT (25), Wave 2: Finance (100), Wave 3: Ops (400), Wave 4: rest. Orbital on dev group. XDR integration for triage.
Policy Servers — SQL in audit mode with exclusions for SQL data/log folders, MDF/LDF, backup paths. Flip to protect mode after 7 days of clean alerts.