Amp for Endpoints maximum time range

Diego Leitao — Fri, 21 Feb 2020 05:09:12 GMT

Hello,

I would like to know the maximum time range of device trajectory.

Is it just 30 days?

Thanks!

Re: Amp for Endpoints maximum time range

Matthew Franks — Thu, 30 May 2019 19:21:06 GMT

Diego,

That is correct. The limit on Device Trajectory (version 2) is 30 days. The legacy Device Trajectory was 4,000 events but that is nearly phased out at this point. If you would like additional storage, we recommend setting up an Event Stream with the API and ingesting the events with a SIEM.

Information on setting up an API key is on page 218 of the User Guide:
https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20User%20Guide.pdf

Information on setting up an Event Stream can be found here:
https://api-docs.amp.cisco.com/api_actions/details?api_action=POST+%2Fv1%2Fevent_streams&api_host=api.amp.cisco.com&api_resource=EventStream&api_version=v1

Thanks,

Matt

Re: Amp for Endpoints maximum time range

Diego Leitao — Thu, 30 May 2019 20:09:04 GMT

Thank you very much Matthew!!

topic Re: Amp for Endpoints maximum time range in Endpoint Security

Amp for Endpoints maximum time range

Re: Amp for Endpoints maximum time range

Re: Amp for Endpoints maximum time range