topic Re: Does Endpoint AMP send syslog event ? in Endpoint Security

Does Endpoint AMP send syslog event ?

peter.peng — Fri, 21 Feb 2020 05:06:49 GMT

Hi Sir:

Does Endpoint AMP send syslog event or send the log by any methods ?

Re: Does Endpoint AMP send syslog event ?

David Janulik — Tue, 06 Nov 2018 11:02:58 GMT

Hello,

AMP agent sends events to AMP console, for further details. The typical Syslog is not paired in any way with AMP agent. If Security Operation wants such output, need to use API. With REST API you are able to pull data, or run them regulary using e.g. cron jobs.

Hope that answers your question

David

Re: Does Endpoint AMP send syslog event ?

AlexPi — Tue, 06 Nov 2018 12:04:05 GMT

I think this is what you need: Overview of the Cisco AMP for Endpoints API

Re: Does Endpoint AMP send syslog event ?

jefburke — Wed, 07 Nov 2018 19:28:16 GMT

Hi Peter,

Neil and Evgeny have an Endpoint Security Ask The Expert thread going right now. It has a good focus on AMP. You should try posting this question and others there!

Here is the link: https://community.cisco.com/t5/advanced-threats/ask-the-expert-endpoint-security-the-daunting-challenges-of-the/td-p/3736946

I may not be able to help much, be he can!

Re: Does Endpoint AMP send syslog event ?

peter.peng — Thu, 08 Nov 2018 02:21:35 GMT

Hi Jefburke: