The switch port MAC address security setting that must be used is sticky. This option allows the switch to dynamically learn the MAC addresses of the devices connected to the port and add them to the running configuration. If the port is shut down or the switch is restarted, the MAC addresses remain associated with the port and are not aged out. This way, the engineer can limit the number of MAC addresses per port and prevent unauthorized devices from accessing the network. The sticky option also allows the engineer to manually configure some MAC addresses and let the switch learn the rest. References:
* Configuring Port Security - Cisco (Section: Allowing Traffic Based on the Host MAC Address)
* How to configure port-security on Cisco Switch - NetworkLessons.com (Section: Sticky MAC addresses)
* Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0 (Module 5.1.1)

Explanation:
Diagram Description automatically generated

The Cisco Endpoint IoC feature is a powerful incident response tool for scanning of post-compromise indicators across multiple computers. Endpoint IoCs are imported through the console from OpenIOC-based files written to trigger on file properties such as name, size, hash, and other attributes and system properties such as process information, running services, and Windows Registry entries. The IoC syntax can be used by incident responders to find specific artifacts or use logic to create sophisticated, correlated detections for families of malware. Endpoint IoCs have the advantage of being portable to share within your organization or in industry vertical forums and mailing lists. The Endpoint IoC scanner is available in AMP for Endpoints Windows Connector versions 4 and higher. Running Endpoint IoC scans may require up to 1 GB of free drive space. The Endpoint IoC feature is based on the openioc.com framework, which is an open standard for sharing threat intelligence. References:
* Cisco Endpoint IOC Attributes, User Guide
* What Are Indicators of Compromise (IOC)? - Cisco, Security Indicators of Compromise
* General questions about AMP - Cisco Community, Post by Cisco Employee Reference: https://docs.amp.cisco.com/Cisco%20Endpoint%20IOC%20Attributes.pdf The Endpoint Indication of Compromise (IOC) feature is a powerful incident response tool for scanning of post-compromise indicators across multiple computers.