In reply to Murilo Rocha.

Hi Murilo,

The endpoint connector for AMP for Endpoints is a lightweight 20mb application and no user will even notice it's there. Furthermore, unlike a traditional client that does heavy scans and analysis on the device itself (using up cycles and impacting users), AMP does all the heavy lifting in the cloud.

With regard to deployment of AMP for Endpoints vs. AMP for Networks (AMP on a FirePOWER NGIPS), it really just depends on the level of visibility and control you want to achieve, and this varies based on the specific needs of each organization, their current security architecture, etc. Many deploy AMP for Networks alone or AMP for Endpoints alone - each are a powerful tool on their own and gives the organization the level of visbility and protection they need. Of course, the endpoint deployment gives you visibility into application/executable information on endpoints, which some organizations really value. Many also deploy AMP for Endpoint and AMP for Network together, which gives the ultimate in visibility and control because the products communicate and share information with eachother to correlate events on the endpoint and on the network level to help you detect and remediate threats even faster.

For more information on AMP for Endpoint, I would recommend watching this overview video here: https://www.youtube.com/watch?v=gfIIczWAF7o&index=7&list=PL6FEA443253B44EC2 and for a demonstration of AMP for Endpoints and also how it integrates with AMP Threat Grid and AMP for Networks, check this out: https://www.youtube.com/watch?v=sRqlHdxAP5g&index=1&list=PL6FEA443253B44EC2