Cisco AMP

Overview

The Cisco AMP integration enables ThreatAware to collect data from your Cisco AMP system.

Connection Method: API Setup Time: 15 minutes Access Required: Administrator account

Identify API Endpoint

The API endpoint is determined by your console’s URL, such as:
api.amp.cisco.com
api.apjc.amp.cisco.com
api.eu.amp.cisco.com
For example, if your console URL is amp.cisco.com, then your API Endpoint is api.amp.cisco.com.

Create API Credentials

Navigate to Accounts > API Credentials within the Cisco AMP console.
Click New API Credential and provide an application name, e.g., “ThreatAware Integration.”
Set Scope to Read & Write.
Copy the Client ID and API Key generated.

Input Details in ThreatAware

In ThreatAware, go to Integrations and select Cisco AMP.
Enter the API Endpoint, Client ID, and API Key into the appropriate fields.

API Endpoint

Cisco AMP endpoint URL.

Field: API Endpoint
Name: Cisco AMP API Endpoint
Type: String
Placeholder: "api.eu.amp.cisco.com"

Client ID

Client ID generated in Cisco AMP.

Field: Client ID
Name: Cisco AMP Client ID
Type: String

API Key

Secure key associated with the Client ID.

Field: API Key
Name: Cisco AMP API Key
Type: Password

Verification

In ThreatAware, confirm the Integration Status shows as Active after configuration.

Troubleshooting

Invalid API Endpoint: Ensure the correct regional endpoint is entered.
Permission Issues: Confirm the API credentials have Read & Write scope enabled.

For API scope and permission requirements, consult the Cisco AMP API Documentation.
API Endpoint and credentials are region-specific, so confirm the endpoint matches your account’s location.