Cisco AMP/TG/Umbrella/CTR Intelligence Search

Cisco AMP/TG/Umbrella/CTR Intelligence Search插件简介

Cisco AMP/TG/Umbrella/CTR Intelligence Search插件描述

V0.0.14
 Fixed Investigate in Cisco Threat Response to use the respective regional AMP cloud configured in extension options settings.
V0.0.13
 Rebred AMP Visibility to Cisco Threat Response.
 Cisco Threat Response should be the primary search interface...  Moved it to top
 Updated selected text search to Cisco Threat Response with better input validation/sanitization
 Additional selected text input parsing to automatically change hxxp(s) to http(s) f directly pivoting from Talos Blog posts
 Additional selected text input parsing to automatically change IP Addresses  domains from w[.]x[.]y[.]z to w.x.y.z f directly pivoting from Talos Blog posts.
 Added suppt f AMP APJC Cloud in options menu
V0.0.12
 Updated search to include strings any selected text to Cisco AMP Visibility
V0.0.11
 Updated search to Sourcefire AMP to reflect bring change to Cisco AMP
V0.0.10
 Updated Opendns/ODNS to reflect bring change to Cisco Umbrella
 Also updated Investigate lookups to investigate.umbrella.com
v0.0.9
 Added an extension Options page that allows:
   o selection of AMP US  EU Clouds
     Direct EU Console search will soon be deprecated in fav of options
   o definition of an AMP Private Cloud server to extend search into
      Suppts FQDN (e.g. privateamp.example.com)  IP Address
V0.0.8
 Added hash search into OpenDNS Investigate
V0.0.7
 Added Context Based search to search back within Cisco AMP f Endpoints console f selected text by Hash, filename, device name, URL  IP Address.
v0.0.6
 Added OpenDNS Investigate search options

Context Menu enabled Threat Intelligence search of selected text
URL  Searches Cisco AMP Threat Grid f any known threat intelligence associated to the URL
URL  Searches Cisco OpenDNS f any known threat intelligence associated to the FQDN in URL
IP/Domain  Searches Cisco AMP Threat Grid  OpenDNS Investigate f any known threat intelligence
MD5/SHA Hash  Searches Cisco AMP Threat Grid f any known threat intelligence associated to the file.  Does not search OpenDNS since hashes are not indexed there.
                                

Cisco AMP/TG/Umbrella/CTR Intelligence Search插件离线安装方法

1.首先用户点击谷歌浏览器右上角的自定义及控制按钮，在下拉框中选择设置。

2.在打开的谷歌浏览器的扩展管理器最左侧选择扩展程序或直接输入：chrome://extensions/

3.找到自己已经下载好的Chrome离线安装文件xxx.crx，然后将其从资源管理器中拖动到Chrome的扩展管理界面中，这时候用户会发现在扩展管理器的中央部分中会多出一个”拖动以安装“的插件按钮。

4.下载 Cisco AMP/TG/Umbrella/CTR Intelligence SearchChrome插件v0.0.14.1版本到本地。

5.勾选开发者模式，点击加载已解压的扩展程序，将文件夹选择即可安装插件。

注意：最新版本的chrome浏览器直接拖放安装时会出现“程序包无效CRX-HEADER-INVALID”的报错信息，参照这篇文章即可解决