Lifecycle Advantage AMP Adopt Campaign

Lifecycle Advantage AMP
Adopt Campaign Objectives

Primary objective: Make sure our customers are USING and REALIZING VALUE from AMP for Endpoints.

This digital journey will help us:

Scale customer engagement coverage

Accelerate adoption to establish loyalty

Facilitate expand opportunities

Ensure renewals

Target Customers

All existing AMP for Endpoints customers.

Lifecycle Advantage will leverage the following AMP Telemetry datapoints to target customers for this campaign:

	Contact login information and the associated time of login
	Percentage and number of endpoints deployed
	Cognitive Threat Analytics (CTA): Identified areas where customer is having trouble with configuration
	Feature Utilization:
	• Active endpoint IOCs
	• Auto analysis for low prevalence
	• Blocking lists
	• Exclusion lists
	• IP blacklists
	• IP whitelists
	• Non default groups
	• Non default policies
	• Own tg api key
	• Simple customer detection lists
	• Whitelists

Lifecycle Advantage Partner Customization

	Co-branded: Yes
	Partner value statement: Available in FY19
	Partner phone number: Available in FY19. Default phone number will route to the Digital Success Manager team, unless partner specifies otherwise.

Digital Journey

Please click through the buttons below to explore the Digital Journey.

Welcome

Desired customer action: Activate the AMP for Endpoints management console.

This email is sent to net new customers within 30 days of purchase.

This communication is intended for the AMP for Endpoints / IT Security Administrator at [COMPANY NAME]. (If you are a Cisco Partner or Distributor, please forward the following information to your customer).

Dear Customer,

Thank you for purchasing Cisco Advanced Malware Protection (AMP) for Endpoints. We have received and processed your order #123456789.

Please activate your AMP for Endpoints software by clicking the link below, or pasting the url into your web browser. Access to your management console will not be active until the entitlement process is complete.

[Provisioning Link]

If you need activation or configuration support, open a case with your Cisco.com ID and service contract number (listed on your order invoice) at https://tools.cisco.com/ServiceRequestTool/scm/mgmt/case.

For product benefits, features, and other resources, visit Cisco Advanced Malware Protection (AMP).

Thank you for choosing Cisco AMP for Endpoints.

Your AMP for Endpoints Team

www.cisco.com

Getting Started

This email is sent one week after Welcome email to net new customers who have purchased AMP in the last 30 days and are not assigned a CuSM.

Get your quick-start package: take a tour, view your deployment strategy guide,
and register for training.

Take a four-minute tour of your new Cisco Advanced Malware Protection for Endpoints.

Take the Tour

Get the Deployment Strategy Guide to review system requirements, best practices, and troubleshooting strategies.

Get the Guide

Get insight into attackers, modern threats, and security trends. Apply this knowledge in real-world scenarios and get a detailed walkthrough of remediating infections with your AMP for Endpoints, including deployment, troubleshooting and best practices in a three-day virtual, instructor-led course.

Get Your Certification

You have received this email as a customer of AMP for Endpoints.

Deployment Guidance

One week after Deployment Guidance email is triggered, an evaluation is done. If contact has activated AMP console, they are no longer sent reminder or self-help emails. If contact has NOT activated console, we wait one month, then send another Deployment Guidance email.

After second reminder Deployment Guidance email is triggered, evaluation is done. If contact has activated AMP console, they will receive CTA Activation emails. If NOT, they are sent an Expand email focused on Advanced Services to help with onboarding.

You've activated AMP for Endpoints, now configure it for your environment.

AMP for Endpoints

Hi Professional,

As you deploy your AMP for Endpoints, the default configuration settings should meet most of your needs.

However, if you need to make any modifications to the configuration, check out our checklist of four dos and don’ts for AMP for Endpoints configuration with useful deployment and policy configuration to make sure you set it up right the first time.

Get the Guidelines

Want the complete guide? Check out the Deployment Strategy Guide.

CTA Activation

Evaluation is done on whether CTA has been enabled properly. Each of the emails in the 4-step activation series are triggered on a 3 day cadence depending on the ability for the contact to enable properly. Depending on the issue a contact is having (proxy or data) an associated email will trigger to help them mediate the issue.

CTA Email #1 CTA Email #2 CTA Email #3 CTA Email #4

CTA Not Enabled

See more threats than ever before

AMP for Endpoints:
Cognitive Threat Analytics

Hi Professional,

Discover new threat categories and see more malware than ever before, even in devices where you cannot install an AMP for Endpoints connector.

Activate Cisco Cognitive Threat Analytics (CTA) in your AMP for Endpoints to enable agentless detection.

Here's How

With CTA you can make investigations easier and faster for rapid incident response. Log in to your AMP for Endpoints management console to activate CTA.

You must have one of the supported web proxies (Cisco CWS, Cisco WSA, BlueCoat ProxySG, and McAfee Web Gateway). If you have different proxies or need help, reach out to the Technical Assistance Center for further guidance.

Sincerely,
Your AMP for Endpoints Team

On average, AMP for Endpoints sees about 30 percent more infections with CTA.

You have received this email as a customer of AMP for Endpoints.

CTA Enabled – No Proxy

See more threats than ever before

AMP for Endpoints:
Cognitive Threat Analytics

Hi Professional,

According to our records as of , you started enabling Cognitive Threat Analytics to analyze your web proxy telemetry, but haven't finished yet.

To complete the activation:

•	Log in to your AMP for Endpoints management console.
•	Click the “Configure” button in the CTA section of your Accounts > Business page to finalize your configuration of CTA capability.
•	You will need to add a device account per each one of your physical or virtual web proxies.
•	Please review the configuration manuals for Cisco WSA, BlueCoat ProxySG and, McAfee Web Gateway.

If you would like to see a demo, check out this step-by-step video.

Sincerely,
Your AMP for Endpoints Team

You have received this email as a customer of AMP for Endpoints.

Proxy Configured – No Data

See more threats than ever before

AMP for Endpoints:
Cognitive Threat Analytics

Hi Professional,

According to our records as of , you started enabling Cognitive Threat Analytics (CTA) to analyze your web proxy telemetry, but haven't finished yet. You appear to have added proxy device account(s) in CTA, but your proxies do not appear to be uploading any logs. Can you please review the log export configuration of your proxies?

To finish the activation:

•	Log in to your AMP for Endpoints management console.
•	Click the “Configure” button in the CTA section of your Accounts > Business page to finalize your configuration of CTA capability.
•	You will need to add a device account per each one of your physical or virtual web proxies.
•	Please review the configuration manuals for Cisco WSA, BlueCoat ProxySG and, McAfee Web Gateway.

If you would like to see a demo, check out this step-by-step video.

Sincerely,
Your AMP for Endpoints Team

You have received this email as a customer of AMP for Endpoints.

Proxy Configured – Incorrect Data

See more threats than ever before

AMP for Endpoints:
Cognitive Threat Analytics

Hi Professional,

Are you still interested in enabling Cognitive Threat Analytics to analyze your web proxy telemetry?

It seems that one of your proxies is not configured properly, and some of the exported logs can’t be processed by CTA. Please review the configuration manuals for Cisco WSA, BlueCoat ProxySG, and McAfee Web Gateway.

If you can’t identify any configuration issues, reach out to the Technical Assistance Center for further assistance using CTA within your AMP for Endpoints. When you open your case, report that your CTA provisioning recordings show your proxy logs are not processed correctly and request a CTA level 3 support for resolution.

Sincerely,
Your AMP for Endpoints Team

You have received this email as a customer of AMP for Endpoints.

Training

One week from CTA enablement completion date, Training email is triggered. If contact enables properly, they won't receive CTA help emails and are sent Training email one week after completion.

Get your dashboard details, security IOC cheat sheet, and download Google Authenticator.

AMP for Endpoints

You have activated your AMP for Endpoints management console. Now it’s time to get to know your security resource to quickly detect, contain, and remediate malware.

Get to Know Your Dashboard

Watch this 4-minute tour about your new AMP for Endpoints. Then, take some time to explore in your own management console.

Take the Tour

Recognize Indications of Compromise

Indications of compromise (IOC) are complex behavioral clues captured in real time across multiple computers. AMP for Endpoints analyzes devices with IOCs based on events observed over the last seven days and displays a prioritized list. Check out your IOC cheat sheet.

Recognize IOCs

Enable File Fetch

Turn on the power of dynamic file analysis to help uncover suspicious files and unknown malware with file fetch in AMP for Endpoints. To use this feature, you must enable two step authentication, which requires a token generator like Google Authenticator.

Download on Google Play

Download on App Store

You have received this email as a customer of AMP for Endpoints.

Low Prevalence

Two weeks after training email is sent, an evaluation is done on whether the prevalence feature has been activated. If it has been activated, contact is evaluated on whether visibility features of AMP are being used.

Detect and block ransomware

AMP for Endpoints

Prevalence on your AMP for Endpoints Dashboard

Hi Professional,

Ransomware is quickly becoming the most profitable type of malware ever detected—on its way to being a billion-dollar annual market. Don’t pay the ransom. Activate the Prevalence feature on your Cisco Advanced Malware Protection (AMP) for Endpoints dashboard.

To learn how to activate this feature, watch the demonstration:

Watch the demo

With the Prevalence feature, you can automatically submit low-prevalence files for dynamic malware analysis, significantly improving visibility and detection.

The Low Prevalence page makes it easy for you to see files that have been executed across your organization. By automatically submitting them for analysis, you can find previously undetected threats.

To start activating the Prevalence feature, log into your AMP console.

If you run into technical issues during your activation, open a support case or connect with your peers and Cisco experts on the AMP for Endpoints support community.

The AMP for Endpoints Prevalence feature was used to detect and block the WannaCry ransomware, executable within 60 minutes of the first identified sample.

You have received this email as a customer of AMP for Endpoints.

Feature Utilization

This 4-touch email series is designed to identify areas where customer is not using the feature and provide resources to help educate and encourage use.

Feature Email #1 Feature Email #2 Feature Email #3 Feature Email #4

Evaluation of whether features are being utilized is done. If they are not utilizing Continuous Analysis, Feature Utilization Email #1 is triggered. If contact does take advantage of the feature, dynamic content will congratulate and encourage usage.

Get a full record of a threat’s history: Use file trajectory and device trajectory.

AMP for Endpoints

Feature Focus #1: Continuous Analysis

AMP inspects files at point of entry into your network. Regardless of disposition, AMP continues to watch, analyze, and record file activity.

If these files ever start exhibiting malicious behavior, you receive an indication of compromise with a full record of the threat’s history: where it came from, where it’s been, and what it’s doing.

Get Better Visibility

Check out “Three Ways to Get Better Visibility into Your Endpoints” to learn about the AMP for Endpoints features designed to provide you with continuous analysis.

Then login to your management console to start using your indications of compromise, device trajectory, and file trajectory.

You have received this email as a customer of AMP for Endpoints.

Two weeks after Email #1 is sent, an evaluation of whether features are being utilized is done. If they are not utilizing File Analysis and Sandboxing, Feature Utilization Email #2 is triggered. If contact does take advantage of the feature, dynamic content will congratulate and encourage usage.

Prevent and manage breaches using file analysis and sandboxing.

AMP for Endpoints

Feature Focus #2: Better Visibility, Better Threat Defense

With your AMP for Endpoints, you have global threat intelligence, advanced sandboxing, and real-time malware blocking, so you have the visibility you need to prevent breaches.

Take Action: Three Steps to Better Threat Defense

Upload an executable into the sandbox environment to analyze behavior and score the threat level of that behavior.

Get the detailed results of that file analysis in about seven minutes. All analysis results are added to the collective intelligence and are searchable with elastic search.

Pivot from an indicator in a file analysis report to view everywhere else it has been in the entire enterprise.

See sandboxing in action

Use file analysis and sandboxing. Log in to your management console.

You have received this email as a customer of AMP for Endpoints.

Two weeks after Email #2 is sent, an evaluation of whether features are being utilized is done. If they are not utilizing Retrospective Security, Feature Utilization Email #3 is triggered. If contact does take advantage of the feature, dynamic content will congratulate and encourage usage. **Emails #1, #2 and #3 are focused on feature utilization related to Visibility.

Watch a demo to see retrospective security and quarantining in action.

AMP for Endpoints

Feature Focus #3: Retrospective Security

Did you know that with retrospective security you can roll back time on would be attackers even after malware has already infiltrated the extended network?

Watch a demo

AMP for Endpoints traces processes, file activities, and communications to give you the full view of an infection and establish root causes, so you can remediate with just a few clicks.

Check out the video to see retrospective security and quarantining in action. Then, log in to your management console to see if you have any updates.

Of all the detection events alerted by AMP, an average of 18% are retrospective security alerts.

You have received this email as a customer of AMP for Endpoints.

Two weeks after Email #3 is sent, an evaluation of whether features are being utilized is done. If they are not utilizing Malware Detection, Outbreak Control and Quarantines, Feature Utilization Email #4 is triggered. If contact does take advantage of the feature, dynamic content will congratulate and encourage usage. **Email #4 is focused on feature utilization related to Control.

Get better control of your network with malware detection and blocking.

AMP for Endpoints

Feature Focus #4:
Malware Detection, Outbreak Control and Quarantines

You have the visibility you need now to implement a strategic defense. Now it’s time to learn how to get better control.

With your AMP for Endpoints, you can stop the spread of malware with just a few clicks.

Here’s how

Check out “How to Stop Malware in its Tracks” to learn how to use malware detection and blocking, build outbreak control lists, and quarantine malicious files.

When malware gets in, it acts quickly. 60% of data is compromised within hours of an attack according to the Ponemon Institute.

You have received this email as a customer of AMP for Endpoints.

Renewal

Emails triggered at 120, 90, 60, 30, and 0 days to expiration, with a final email triggered at -30 days past expiration for qualified customers.

Security Coverage

It's time to renew your Cisco security license. It takes just a minute to get started.

833-800-3667

We’d like to inform you that your security license(s) expires soon. Let us help continue your protection and renew your license before your organization becomes more vulnerable to attacks.

Your contract details:

Service Type	Contract Number	Expiration Date
Advanced Malware Protection	132456789	09/07/2018

Our comprehensive portfolio of security products and services helps you gain clear visibility across your environment, proactively detect and remediate attacks, simplify management, and reduce total cost of ownership. Now is also a good time to install any outstanding software updates to ensure you have the latest security protections.

Need more information? To review contract details, contact your Cisco partner.

Thank you for your continued business.

P.S. Based on your current security architecture, we recommend asking your partner about these Cisco Security products:


AnyConnect	Cisco Umbrella	Email Security

If you don’t handle Cisco security renewals for your organization, please forward this message to the appropriate party. If you have already renewed your contract or have received this notice in error, please disregard this message.

Journey Assets

AMP Assets for Email Journey

AMP on Cisco.com

AMP Feature Focus asset