topic Re: What is the difference between Cisco Secure Endpoint(AMP) and EDR in Endpoint Security

What is the difference between Cisco Secure Endpoint(AMP) and EDR ?

junaid-rehman — Thu, 12 Dec 2024 06:54:03 GMT

Hi Everyone,

I’m posting this to understand the key differences between Cisco Secure Endpoint (CSE) and Cisco EDR.

We’re currently trying to integrate Cisco Secure AMP with our third-party monitoring and ticketing system. During this process, we discovered that "Cisco EDR supports webhooks, which allows integration with HaloPSA for ticket generation. However, at the moment, we only have Cisco AMP, which unfortunately doesn’t support webhooks."

Could someone explain the basic and straightforward differences between EDR and CSE?

Thanks in advance!

Re: What is the difference between Cisco Secure Endpoint(AMP) and EDR

Ken Stieers — Thu, 12 Dec 2024 11:45:25 GMT

Looks like that's a quote from somewhere, do they mean Cisco XDR?

AMP is Cisco's 'EDR' product.

XDR is the platform product that contains Automation that can call webhooks as part of workflows you write.

Re: What is the difference between Cisco Secure Endpoint(AMP) and EDR

junaid-rehman — Thu, 12 Dec 2024 11:52:30 GMT

Thank you @Ken Stieers

Is there any way to automate and call webhooks from Cisco EDR (AMP) to integrate with a third-party ticketing system for generating tickets?

Re: What is the difference between Cisco Secure Endpoint(AMP) and EDR

Ken Stieers — Thu, 12 Dec 2024 16:22:25 GMT

As far as I know, no... and there's no reference to "webhook" in the help or API docs.
You CAN create an event filter and subscribe to it and send it to an email account that the ticketing system can create a ticket from.

Re: What is the difference between Cisco Secure Endpoint(AMP) and EDR

junaid-rehman — Fri, 13 Dec 2024 06:17:02 GMT

Thank you for your response.

Understood. I have one more query: Is it possible to add the same user to multiple organizations? For example, can a user with the email abc@xyz.com be added to multiple organizations?

Re: What is the difference between Cisco Secure Endpoint(AMP) and EDR

Matthew Franks — Fri, 13 Dec 2024 12:17:55 GMT

A user can be part of many organizations. An administrator from each one can send an invitation. When logging in, the user would be prompted to select which organization to log in to.

-Matt