Advanced Threat Solutions Troubleshooting Reference Guide

Available Languages

Download Options

PDF (835.6 KB)
View with Adobe Reader on a variety of devices
ePub (808.4 KB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (435.4 KB)
View on Kindle device or Kindle app on multiple devices

Updated:April 30, 2024

Document ID:215624

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

This document describes the Advanced Threat Solutions (ATS) documentation links for products like Cisco Secure Endpoint, Cisco Secure Malware Analytics, Cisco Threat Response (CTR), and Cisco SecureX.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

This document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The following article is a reference guide for the configuration/troubleshooting of Advanced Threat Solutions products. This article can be referred to before engaging Cisco TAC.

Cisco Secure Endpoint Documentation links

Product Portals	Related Articles		Tags
Public Cloud US Cloud EU Cloud APJC Cloud	General Documentation
	Install, Configure and Uninstall Secure Endpoint Connector for Windows
	Required Server Addresses for Proper Secure Endpoint & Secure Malware Analytics Operations
	Secure Endpoint Connector Support Policy
	Secure Endpoint Deployment Methodology and Best Practices
	Entitlement for Secure Endpoint
	Secure Endpoint Notification Emails
	Configure and Manage Exclusions in Secure Endpoint	Video
	Cisco-Maintained Exclusion List Changes for Secure Endpoint Console
	Best Practices for Secure Endpoint Exclusions
	Configure a Simple Custom Detection List on the Secure Endpoint Portal
	Secure Endpoint Console and the Last Seen Filter
	Export an Application Blocklists from the Secure Endpoint Portal with APIs
	How to Create an Event Stream with Secure Endpoint APIs
	How to Submit a File in Secure Malware Analytics from the Secure Endpoint Portal?
	Opt-In and Enable Orbital Advanced Search in your Secure Endpoint Deployment
	Troubleshooting TETRA definitions update failures
	Secure Endpoint Integration with Splunk
	Configure Pop-Up Notification in Secure Endpoint
	Troubleshoot False Positive File Analysis Events in Secure Endpoint
	Secure Endpoint - Orbital Logs Filling Up with Errors - CSCwh73163
	Secure Endpoint on AWS Workspaces - Startup and Setup scripts for Golden Images
	Secure Endpoint Forensic Snapshot Information
	Review Secure Endpoint (CSE) Windows Scans
	Identify Conditions to Trigger Automated Actions in Secure Endpoint

Android Connector	Obtain Troubleshoot Data on an Android Device for Secure Endpoint
	Secure Endpoint Android Connector OS Compatibility

iOS Clarity	Cisco Security Connector Apple iOS Compatibility
	Create Report Problem / Diagnostic data from Secure Endpoint Cisco Security Connector
	How to Supervise an iOS Device for Use with Cisco Security Connector (CSC)?

Windows Connector	Collection of Diagnostic Data from a Secure Endpoint Connector Running on Windows
	Secure Endpoint Windows Connector OS Compatibility
	Secure Endpoint Windows Connector Update Reboot Requirements
	End-of-Support Announcement for Secure Endpoint Connector Versions
	End-of-Support Announcement for Windows XP, Windows Vista, and Windows 2003 for the Secure Endpoint Connector
	FAQ for Existing Customers as of January 8, 2020 Regarding New Secure Endpoint Packages
	Configure Windows Policy in Secure Endpoint	Video
	[External] - Command Line Switches for Secure Endpoint Connector Installer
	Secure Endpoint Command Line Switches
	Force Manually the TETRA Definitions Update - Secure Endpoint	Video
	Secure Endpoint Update Server Configuration Steps
	How to collect ProcMon logs to troubleshoot Secure Endpoint issues at startup
	Create an Advanced Custom Detection List in Cisco Secure Endpoint
	Analyze Secure Endpoint Diagnostic Bundle for High CPU
	How to Uninstall Secure Endpoint Windows Connector with Safe Mode
	Procedure to uninstall the Secure Endpoint connector if the password is forgotten
	Windows Process Starts Before Secure Endpoint Connector Workaround - Secure Endpoint
	Secure Endpoint Exploit Prevention Engine Compatibility with EMET
	Exploit Prevention
	Cisco Secure Endpoint Guide to Identity Persistence
	List of Root Certificates Required for Secure Endpoint Installation on Windows
	Secure Endpoint Windows Connector Installer Exit Codes
	Troubleshoot Script Protection in Secure Endpoint
	Device Control limitations in VMWare Environments
	Troubleshoot TETRA Definitions Update Failure with 3000 Error
	Configure Custom Detections - Advanced with ClamAV SIGTOOL.EXE on Windows
	Troubleshoot Secure Client Full\|Network Install Wizard Installation Issues
	Configure a Custom Time for TETRA Downloads

Linux Connector	Collection of Diagnostic Data from Secure Endpoint Linux Connector
	Secure Endpoint Linux Connector OS Compatibility
	Secure Endpoint Linux Connector Update Reboot Requirements
	Installation of the Secure Endpoint Linux Connector	Video
	Secure Endpoint ClamAV Virus Definition Options in Linux
	Cisco Secure Endpoint Mac/Linux CLI
	Secure Endpoint Linux Connector Faults
	Resolve Linux Connector SE Linux Policy Fault
	Basic Troubleshoot Guide for Secure Endpoint Linux Connector
	Secure Endpoint Linux Primer
	Secure Endpoint Linux Connector on Ubuntu
	Advisory for Secure Endpoint Linux Connector 1.15.0 on Ubuntu 20.04.0 LTS and Ubuntu 20.04.1 LTS
	Linux Kernel-Devel Fault
	Secure Endpoint Linux Connector Long Term Support
	Troubleshoot Secure Endpoint Linux Connector Fault 18
	Troubleshoot Fault ID 11 on SUSE Linux Secure Endpoint

Mac Connector	Secure Endpoint Connector for Mac Diagnostic Data Collection
	Secure Endpoint Mac Connector OS Compatibility
	Analyze macOS Secure Endpoint Diagnostic Bundle for High CPU
	Secure Endpoint Process Exclusions in macOS and Linux
	Secure Endpoint Mac Connector Performance Tuning Guide
	MAC Kernel and Full Disk Access in the Console - Secure Endpoint
	Manual Uninstall Procedure for Secure Endpoint Mac Connector
	Advisory for Secure Endpoint Mac Connector 1.14 on macOS 11 (Big Sur), macOS 10.15 (Catalina), and macOS 10.14 (Mojave)
	Secure Endpoint Mac Connector Faults
	Configure Permissions for Secure Endpoint Mac Connector and Orbital with MDM: Full Disk Access, System Extensions
	Secure Endpoint Mac Proxy Automatic Configuration (PAC) Setup Guide

Private Cloud	General Documentation
	Secure Endpoint Private Cloud Support Policy
	Installation and Configuration of Secure Endpoint Virtual Private Cloud
	Re-Image the Secure Endpoint Private Cloud PC3000 and Restore the Backup
	Generate and Add Certificates that are Required for Installation of Secure Endpoint Private Cloud 3.x Onwards
	Upgrade Procedure for AirGapped Secure Endpoint Private Cloud (Virtual and Appliance)
	Generate Secure Endpoint Private Cloud Support Snapshot and Enable Live Support Session
	Accessing the CLI of Secure Endpoint Private Cloud via SSH and Transferring Files via SCP
	Secure Endpoint Private Cloud 3.0.1 upgrade procedure
	Upgrading to Secure Endpoint Private Cloud 3.1.1 - adding disk space and memory
	EOS Announcement for Secure Endpoint Private Cloud Versions
	Secure Endpoint Private Cloud - Authentication Certificates Expiration 2024
	Troubleshoot Event Stream on Private Cloud
	Secure Endpoint - Private Cloud Root CA Certificate Expiration 2023
	Install and Configure of Secure Endpoint Virtual Private Cloud

Efficacy/Remediation/Compliancy	Outbreak/Infection (Incident Response)

Cisco Secure Malware Analytics Appliance

Product Portals	Related Articles	Tags
Cisco Secure Malware Analytics Appliance	Configuration Guides
	Install and Upgrade Guides
	Secure Malware Analytics Appliance System Version
	End-of-Sale and End-of-Life Announcement
	Configure Secure Malware Analytics Appliance for Cluster Operations
	Generate Secure Malware Analytics Support Snapshot and Enable Live Support Session
	Setting up SSH client for Cisco Secure Malware Analytics Appliance
	Update Secure Malware Analytics Appliance Air-Gap mode
	Generate Secure Malware Analytics Support Snapshot and Enable Live Support Session
	Configure Secure Malware Analytics Appliance with Prometheus Monitoring Software
	How to Boot Secure Malware Analytics Appliance into Recovery Mode with EFI Shell and Add Recovery Mode to Boot Options
	Update Secure Malware Analytics Appliance Air-Gap mode
	Configure Secure Malware Analytics RADIUS over DTLS Authentication for Console and OPadmin Portal
	Configure Secure Malware Analytics Appliance Third-Party Integrations
	Troubleshoot Samples and Devices Not Present in Secure Malware Analytics Appliance Dashboard
	Troubleshoot of Secure Malware Analytics Appliance Integration with FMC
	Secure Malware Analytics Video Playlist
	Configure Secure Malware Analytics Appliance with Umbrella
	Fix Secure Malware Analytics Appliance Initial Setup Issue
	Secure Malware Analytics Appliance does not accept CA certificate
	Secure Malware Analytics Appliance is advising a required reset needs to be completed before version 3.0 can be installed
	How to download the certificates from (self-signed) Secure Malware Analytics Appliance for integration purposes?
	Using an external load balancer with a Secure Malware Analytics Appliance Cluster

Cisco SecureX

Product Portals	Related Articles		Tags
Cisco SecureX US Cloud EU Cloud APJC Cloud	Configuration Guides
	SecureX Reference Guide
	SecureX Blogs
	SecureX FAQs
	Cisco Live On-Demand Library
	Cisco SecureX Video Playlist
	Cisco Live 2023! Secure Endpoint and SecureX Sessions

SecureX Threat Response [formerly Cisco Threat Response(CTR)] US Cloud EU Cloud APJC Cloud	Integrate CTR and Secure Malware Analytics
	Integrate Cisco Threat Response and Firepower
	Troubleshoot on the FMC and CTR Integration
	Cisco Threat Response (CTR) and ESA Integration	Video
	ESA: File Reputation and File Analysis
	Integrate WSA with CTR
	CTR FAQs
	Cisco Threat Response Configuration Tutorials
	Cisco Threat Response Video Playlist

SecureX Orchestrator US Cloud EU Cloud APJC Cloud	SecureX Orchestration Tutorial
	Pondering Automations - Cisco Community
	ActionOrchestratorContent - Github

Integrations related articles

Product Portals	Related Articles	Tags
Cisco Secure Endpoint US Cloud EU Cloud APJC Cloud	Integrating Secure Endpoint with FMC
	Installation and Configuration of AMP Module Through AnyConnect 4.x and AMP Enabler
	ESA/CES - Procedure to register clustered appliances to Secure Endpoint
	Integration of AMP Virtual Private Cloud and Threat Grid Appliance
	Integrate Secure Endpoint and Secure Malware Analytics with WSA

Cisco Secure Malware Analytics US Cloud EU Cloud	Umbrella and Secure Malware Analytics Integration
	File Analysis Client ID on Content Security Appliances (ESA, SMA, WSA) and DC/FMC
	Required IPs and Ports for Secure Malware Analytics

Cognitive Threat Analytics / Global Threat Alerts (CTA)	CTA Demo with Secure Endpoint
	Secure Endpoint Global Threat Alerts (GTA) End of Service FAQ