Cisco AMP and Malwarebytes

First thing I'll ask is how you're using AMP. Naturally, it does malware, but are you also using the AV portion of it (TETRA for Windows, Clam AV for other OSes)?

was wondering when I run Malwarebytes on some workstations, there are many Items that I need to quarantine that I think Cisco AMP should have captured or rejected?

Could you be more specific? Give some examples?

We do use the TETRA for windows.  One of the problems we presently have is that since joining the company a few months ago, seems like everyone has admin rights, which obviously is a no-no in security and we're working through this now.

AMP works pretty well at least on the malware side. However I have seen in the cases of files with scripting in them, the false positive rate goes up pretty fast. For the most part we dont use TETRA since we had McAfee already, but it has been pretty solid.

So our first line of defense is Cisco AMP, but again, sometimes this software does not always catch things.  We normally go in to the machine when we receive an alert from AMP and then run Malwarebytes at that point, but in my opinion is that why does Cisco AMP not catch things in the first place.

To be fair, no product will catch everything. And Cisco doesn't pitch AMP as an AV replacement... yet.

Wait a sec, you're saying you're getting AMP alerts then using Malwarebytes? So what is AMP alerting on and what are you saying Malwarebytes catches that AMP does not?

I am also assuming you have machines in the Protect policy or a custom one?

For example, the image below shows the settings presently on our machines.  This a protected policy...

We have a daily flash scan and weekly full scan.
conviction-mode-_-Cisco-AMP.PNG

The problem really occurs when we get alerted from within Cisco AMP where it either quarantines or not quarantines a file and then I go to the machine and run Malwarebytes.  I sometimes witness multiple items within Malwarebytes that I'm not sure if Cisco AMP should have caught in the first place.  

Another question:
Is anyone using Malwarebytes as a secondary check or have it installed on their network and if so, how is it being used?  Is it run daily/weekly or how is it really setup?  We have about 600 computer/laptops and curious about the whole process.

Could you give some examples?