> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cisco AMP

> Connect ThreatAware to Cisco AMP

## Overview

The Cisco AMP integration enables ThreatAware to collect data from your Cisco AMP system.

<Info>
  **Connection Method**: API
  **Setup Time**: 15 minutes
  **Access Required**: Administrator account
</Info>

## Setup instructions

<Steps>
  <Step title="Log in to Cisco AMP Console">
    * Access the [Cisco AMP Console](https://console.amp.cisco.com) with an administrator account.
  </Step>

  <Step title="Identify API Endpoint">
    * The API endpoint is determined by your console’s URL, such as:
    * `api.amp.cisco.com`
    * `api.apjc.amp.cisco.com`
    * `api.eu.amp.cisco.com`
    * For example, if your console URL is `amp.cisco.com`, then your API Endpoint is `api.amp.cisco.com`.
  </Step>

  <Step title="Create API Credentials">
    * Navigate to **Accounts** > **API Credentials** within the Cisco AMP console.
    * Click **New API Credential** and provide an application name, e.g., "ThreatAware Integration."
    * Set **Scope** to **Read & Write**.
    * Copy the **Client ID** and **API Key** generated.
  </Step>

  <Step title="Input Details in ThreatAware">
    * In ThreatAware, go to **Integrations** and select **Cisco AMP**.
    * Enter the **API Endpoint**, **Client ID**, and **API Key** into the appropriate fields.
  </Step>
</Steps>

## Input details

<AccordionGroup>
  <Accordion title="API Endpoint" icon="key">
    Cisco AMP endpoint URL.

    ```text theme={null}
    Field: API Endpoint
    Name: Cisco AMP API Endpoint
    Type: String
    Placeholder: "api.eu.amp.cisco.com"
    ```
  </Accordion>

  <Accordion title="Client ID" icon="key">
    Client ID generated in Cisco AMP.

    ```text theme={null}
    Field: Client ID
    Name: Cisco AMP Client ID
    Type: String
    ```
  </Accordion>

  <Accordion title="API Key" icon="key">
    Secure key associated with the Client ID.

    ```text theme={null}
    Field: API Key
    Name: Cisco AMP API Key
    Type: Password
    ```
  </Accordion>
</AccordionGroup>

## Verification and troubleshooting

<AccordionGroup>
  <Accordion title="Verification" icon="triangle-exclamation">
    In ThreatAware, confirm the **Integration Status** shows as **Active** after configuration.
  </Accordion>

  <Accordion title="Troubleshooting" icon="triangle-exclamation">
    * **Invalid API Endpoint**: Ensure the correct regional endpoint is entered.
    * **Permission Issues**: Confirm the API credentials have **Read & Write** scope enabled.
  </Accordion>
</AccordionGroup>

## Important notes and links

* For API scope and permission requirements, consult the [Cisco AMP API Documentation](https://developer.cisco.com/docs/amp/).
* API Endpoint and credentials are region-specific, so confirm the endpoint matches your account’s location.