FireSight, SNORT Based

botnets
signature IPS
Analys network
File sandbox


Access Control Policy:
IPS 
FIle
Network Anal
SSL
Netword Descover
Correlation Policy

SEE
ACI Networks


AMP,  ?? sandboxing???

*Suspicious files AMP can analyze based on file hash