topic CISCO Secure Endpoint Third Party Integration Recommendations in Endpoint Security

CISCO Secure Endpoint Third Party Integration Recommendations

ShoreSempai — Fri, 15 Oct 2021 13:28:02 GMT

We have a client who is deploying CISCO Secure Endpoint across their organization and would like to forward critical and high alerts/notifications to our cybersecurity platform. We can support syslogs, custom logs or integration via a REST or other style of API.

We are wondering if there is a recommended/preferred approach? We have been searching to find an answer and don't seem to be getting very far. If you have any suggestions, pointers to articles, presentations or documentation that would be greatly appreciate.

Re: CISCO Secure Endpoint Third Party Integration Recommendations

Ken Stieers — Fri, 15 Oct 2021 13:44:35 GMT

There is an API. API docs are here: https://api-docs.amp.cisco.com/
There's a whole developer site on Dev net here: https://developer.cisco.com/amp-for-endpoints/
Depending upon your platform/SEIM, they may already have facilities to do the ingestion. Splunk surely does. Logrhythm does (OpenCollector, plus someone posted python -> flatfile ingestion years ago...)
Also this page: https://ciscosecurity-amp-00-integration-workflows.readthedocs-hosted.com/en/latest/amp/intro.html
Google "cisco amp api"... in the first 3 pages all of the big players pop up.