Cisco AMP Logs
Overview
Section titled “Overview”Evidence: Cisco AMP Logs
Description: Collect Cisco AMP Logs
Category: Applications
Platform: windows
Short Name: cscmpl
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Cisco AMP (Advanced Malware Protection) for Endpoints is an enterprise security solution that provides advanced threat detection, continuous monitoring, and retrospective security. It stores security event data in database files.
Data Collected
Section titled “Data Collected”This collector gathers structured data about cisco amp logs.
Collection Method
Section titled “Collection Method”This collector gathers Cisco AMP database files from the Program Files installation directory, which contain threat detection data, file reputation information, and endpoint activity logs.
Forensic Value
Section titled “Forensic Value”Cisco AMP databases are critical for investigating advanced malware, providing file trajectory data, threat intelligence, retrospective analysis, and continuous endpoint monitoring. They help trace malware propagation and identify patient zero.