Secure Endpoint CLI Usage & Documentation

TruthNotTruth — Mon, 25 Oct 2021 19:51:18 GMT

Hi all,

Just wondering if Secure Endpoint has any CLI-based tools to assist in remote work on an endpoint itself (e.g., disable the service for troubleshooting, enable debug logging without using the GUI, get/change configuration, etc.); and, if so, if there is accompanying documentation.

"C:\Program Files\Cisco\AMP\*\ipsupporttool.exe"

This seems like a diagnostic tool ( akin to the GUI-based Diagnostics button for computers ), and the IPSupportTool log suggests there are switches for it ([-h] [-d install_path] [-o output_path] [-t timed_support] [-m archive_size] [-j job_id] [-H time_stamp]). However these switches don't appear to work nor is there an archive created post-execution. It just dumps some files in 'C:\Program Files\Cisco\AMP' (installed_app.csv, running_process.csv, installed_services.csv, systeminfo.txt, etc.). These files do not appear to be in the resultant archive from the Console-based 'Diagnostics' feature for a computer.

"C:\Program Files\Cisco\AMP\*\AmpCLI.exe"

Would appear to be the right tool, but only looks to have one option (posture) that prints basic Secure Endpoint status information

"C:\Program Files\Cisco\AMP\*\sfc.exe"

Seems to be the primary Secure Endpoint process for scanning and such, but no CLI interface options

Thank you

topic Secure Endpoint CLI Usage & Documentation in Endpoint Security

Secure Endpoint CLI Usage & Documentation