[Endpoint Protection and Detection] What does Cisco AMP for Endpoints use to help an organization detect different families of malware?

ETHOS is the Cisco file grouping engine. It allows us to group families of files together so if we see

variants of

a malware, we mark the ETHOS hash as malicious and whole families of malware are instantly

detected.

Reference: https://docs.amp.cisco.com/AMP%20for%20Endpoints%20User%20Guide.pdfETHOS =

Fuzzy Fingerprinting using static/passive heuristics

Reference: https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2016/pdf/BRKSEC-2139.pdf