Wednesday, January 6, 2021

Cisco AMP experience -- are false positives common, or is it just me?

We have recently switched to Cisco AMP for device protection. I was given a new laptop, and the new laptop has Cisco AMP. In copying my files from years of work over from the old laptop, Cisco AMP has had hundreds if not thousands of detections that I'm pretty sure are all false positives. Among them include multiple detections of files in a proprietary archive format we use internally that are highly-compressed and not executable, and also Microsoft's PowerShell script for installing the Azure Artifacts credentials provider. Is this an expected experience? If this tool is detecting so many false positives, how can there be confidence in anything it is reporting?



No comments:

Post a Comment