To streamline the process of reviewing events and modifying blocking of specific files across both the firewall console and the endpoint console, the security engineer should initiate the integration between Secure FMC and Cisco Secure Endpoint (formerly AMP for Endpoints) from the Secure FMC using the AMP tab.
Steps:
* In the FMC, navigate to Devices > Device Management.
* Select the device and go to the AMP tab.
* Initiate the integration by configuring the necessary API credentials and linking the FMC to the Cisco Secure Endpoint console.
* This integration allows the security engineer to view endpoint events and apply blocking actions directly from the FMC, consolidating the management tasks.
This approach simplifies the workflow by providing a single interface to manage both network and endpoint security, reducing the time and effort required to maintain security across the organization.
References: Cisco Secure Firewall Management Center and Cisco Secure Endpoint Integration Guide.