topic Retrieve past events from AMP in Endpoint Security

Retrieve past events from AMP

marcelo89_138 — Thu, 18 Jun 2020 16:24:10 GMT

Hello all!

Im trying to extract more than 1 month ago events (.csv) from AMP for Endpoints, but without success.

Is it possible to get this info?

Re: Retrieve past events from AMP

jesutorr@cisco.com — Thu, 18 Jun 2020 17:29:04 GMT

Hi Marcelo,

Thanks for using Cisco Community, regarding your inquiry, unfortunately, the events on the "Event Section" are deleted after 30 days.

On the AMP Console, you can find the event section in Analysis → Events

However, we have other logs that are saved for more than 30days, for example, the Audit Logs, you can find this information on Account → Audit Log

*************

If you want to review the events of a specific device you can find this information directly on the computer, there is a file called "History.db" inside the AMP Folder (Commonly storage in C → Program Files → Cisco → AMP)

If you open the file with a DB Browser

************

You can also create an Event Stream in order to send the events to a SIEM or a device to save all the events.

You can create this Event Stream by generating a Read/Write API (On the Console Navigate to Accounts → API Credentials), in the following link you can find the documentation of how to create the Event Stream https://api-docs.amp.cisco.com/api_resources/EventStream?api_host=api.amp.cisco.com&api_version=v1

I hope this information can be useful to you.

Have a great day!!!

Re: Retrieve past events from AMP

marcelo89_138 — Thu, 18 Jun 2020 19:50:11 GMT

Thats great!

I would like to put this event stream into Splunk, is there any step by step guide?

Re: Retrieve past events from AMP

Matthew Franks — Fri, 19 Jun 2020 13:27:04 GMT

There is no step by step guide, but here is an article about Event Streams and how to set one up. There are also a few Python scripts in github.com/CiscoSecurity that you may find useful. As for the Splunk side, there are two AMP modules you can use.

https://splunkbase.splunk.com/app/3670/
https://splunkbase.splunk.com/app/3686/

Hope that helps!

-Matt