topic Re: Cisco AMP - Is there a way to preserve the device trajectory event in Endpoint Security

Cisco AMP - Is there a way to preserve the device trajectory events?

JuliaMora15110 — Wed, 24 Sep 2025 16:25:56 GMT

Hi all,

I was wondering if anyone knew of a good way to preserve the device trajectory events on a computer, so that it's not lost after 30 days.

I know the Forensic Snapshot can be helpful, but how do I save all of the device trajectory events or even export them from Cisco AMP?

Thank you!

Matthew Franks — Wed, 24 Sep 2025 16:59:20 GMT

There is no way to achieve this through the UI, but you can use the /v1/computers/{connector_guid}/trajectory API endpoint.
More information is available here:
https://developer.cisco.com/docs/secure-endpoint/v1-api-reference-computer/

Thanks,

Matt