Cisco SD-WAN Advanced Malware Protection (AMP) is a security service that allows edge routers to inspect file downloads and detect, block, and retrospectively identify malicious files. AMP is part of the Unified Threat Defense (UTD) security stack, which runs on the router by using the Security Virtual Image. AMP uses the Snort engine running on edge routers and leverages two cloud-based security services:

• AMP Cloud - a context-rich malware database that provides information about encountered files based on millions of samples across thousands of customers. The knowledge-based service is provided by Cisco Talos, one of the world's largest and most trusted commercial cybersecurity providers.
• Secure Malware Analytics (formerly known as Threat Grid) - a unified security solution that provides threat intelligence and advanced sandboxing. The service detonates unknown files in a sandboxing environment and then analyzes their behavior against millions of samples and malware indicators.