topic Re: How to query one group in AMP for an IP Address in Endpoint Security

How to query one group in AMP for an IP Address

tom.power1 — Fri, 10 Jun 2022 17:35:25 GMT

Hi,

In response to a security incident, I would like to query one group of endpoints in AMP (Secure Endpoint) for network connections to a specific IP address.

How can I do that in Orbital?

Thanks for your time.

Have a great day.
T

Re: How to query one group in AMP for an IP Address

nazi.farhadi3171 — Fri, 17 Jun 2022 04:39:48 GMT

Thanks for the information, keep sharing this type of info Marriott Global Source Login

Re: How to query one group in AMP for an IP Address

JennieZhang — Mon, 04 Jul 2022 16:18:26 GMT

hello,

as per my understanding, you have an IP address and you want to find out which endpoints has connected to that IP address, is my understanding correct?

have you tried using Threat Response to investigate the IP address?

https://visibility.apjc.amp.cisco.com/

Threat response can investigate on IP addresses, domains, URLs... you can open Threat Response and paste the IP address in the top field and then click 'investigate'.

Re: How to query one group in AMP for an IP Address

Troja007 — Thu, 07 Jul 2022 07:46:36 GMT

Hello @tom.power1 ,
if I understand right, you want to query a group... e.g. like, select a group of endpoints defined in Secure Endpoint, and starting a query for these endpoint only, right?

If I´m not totally wrong, some work is done in this direction. You may ping your Cisco representative for an official statement. 😉

Greetings,
Thorsten