PDF(44.9 KB) View with Adobe Reader on a variety of devices
ePub(119.4 KB) View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle)(95.3 KB) View on Kindle device or Kindle app on multiple devices
Updated:April 11, 2022
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Linux connector on Debian-based systems uses eBPF for file and network monitoring. The machine must have the correct linux-headers software package installed otherwise the connector will raise fault 11 (Missing System Dependency) and run in a degraded state without file and network monitoring. Guidance for resolving this fault can be found the in the Linux Kernel-Devel Fault article.
The Linux connector depends on system packages that are included in the base installation of Debian-based systems, but if a dependency is missing the following message will appear:
ciscoampconnector depends on <package_name>; however:
Package <package_name> is not installed.
Use the following command to install any missing dependencies required by the Linux connector:
sudo apt install <package_name>
Verifying the DEB package
The Linux connector DEB package contains a signature to verify that the downloaded software package belongs to Cisco.
Downloading the DEB package
Access the AMP for Endpoints console.
Download the DEB package for a Debian-based system.
Transfer the DEB package to the Debian-based system. For example: amp_ciscoampconnector.deb.
Retrieving the GPG Public Key
Click the "Show GPG Public Key" button, as shown in the image below.
If the connector version is earlier than 1.17.0, download and transfer, or copy the public key to the machine. For example: cisco.gpg. If the connector version is at least 1.17.0, the GPG key is available in /opt/cisco/amp/etc/dpkg-gpg/DPKG-GPG-KEY-cisco-amp.
Verifying the DEB package
The DEB package is signed using the debsigs tool and can be verified using debsig-verify.
Install the debsig-verify tool.
sudo apt-get install debsig-verify
Import the Cisco GPG Public Key into the debsigs keyring. Note: As of version 1.17.0, the debsig.gpg file will be created automatically so step 2 can be skipped.
debsig: Verified package from 'Cisco AMP for Endpoints' (Debsig)
Note: Step 5 can be repeated for any Debian-based packages downloaded from the AMP for Endpoints console.
To install the connector execute the following command where [deb package] is the name of the file, for example amp_test.deb:
sudo dpkg -i [deb package]
IMPORTANT! If you are running other security products in your environment, there is a possibility that they will detect the connector installer as a threat. In order to successfully install the connector, add Cisco Secure to an allowed list or exclude Cisco Secure in the other security products and try again.
IMPORTANT! During connector installation, a user and group named cisco-amp-scan-svc are created on the system. If this user or group already exists but is configured differently, then the installer will attempt to delete and then re-create them with the necessary configuration. The installer will fail if the user and group could not be created with the necessary configuration.