topic Data retention and Syslog in Endpoint Security

Data retention and Syslog

kostasthedelegate — Fri, 21 Feb 2020 05:12:01 GMT

Hello,

I have Cisco AMP for Endpoints. It is a new installation.

I would like to ask if there is a possibility to change the data retention setting.

I would like to have data for more than 30 days.

Is there any option to send data to a Syslog server?

Thanks and regards,

Konstantinos

Re: Data retention and Syslog

kostasthedelegate — Tue, 14 Jan 2020 06:48:39 GMT

Hello,
Any ideas?

Re: Data retention and Syslog

Wojciech Cecot — Tue, 14 Jan 2020 09:49:34 GMT

Hi,

If you need to have more than 30 days of Events you can always consider to use the AMP API:
https://api-docs.amp.cisco.com/api_resources?api_host=api.eu.amp.cisco.com&api_version=v1
Event section will be the one, which you can use on your SIEM system. There is even special Splunk extension for the Cisco AMP console which gathers such data:
https://splunkbase.splunk.com/app/3670/

Regular syslog is not possible.

Hope that helps,
Wojciech

Re: Data retention and Syslog

kostasthedelegate — Tue, 14 Jan 2020 11:00:51 GMT

Hello Wojciech,

Thank you for your answer.
Because I am not aware of the API calls. is there any guide, that could be used?
Especially, I would like to find compatibilities with SIEM systems.

Regards,
Konstantinos

Re: Data retention and Syslog

brmcmaho — Thu, 16 Jan 2020 17:06:58 GMT

A new resource for third party integrations with AMP is now available:

https://www.cisco.com/c/en/us/products/security/amp-for-endpoints/AMP-endpoints-partners-integrations.html#~third-party-integrations

Re: Data retention and Syslog

kostasthedelegate — Fri, 17 Jan 2020 14:23:37 GMT

Thanks a lot!!

Will review it!!