Cisco AMP

[Charles Herring]

CISCO AMP CONSOLE

• Create an API Key pair in accordance with Cisco guidance: https://developer.cisco.com/docs/secure-endpoint/#!authentication/authentication

 

PRECINCT CONFIGURATION

• Go to Admin > SOAR > Cisco AMP for Endpoints API > Config
• Click the checkbox for Enable the Cisco AMP for Endpoints API
• Paste the Client ID and API Key
• Click the disk icon (Save)
• Click Jobs and go to Artifacts from Cisco AMP.
• Select Triggers, expanding Manual Trigger and Interval Trigger. 
  • Toggle both to State: ENABLED
• The Interval Trigger is set to 2 hours by default, but you can update it to what best suits your organization. (Recommended: 10 minutes)
• Click the disk icon (Save)

• This topic was modified 4 months, 2 weeks ago by Charles Herring.

[Author]

Posts