AMP: Is it possible to duplicate an Exclusion set?

[matty-boy]

Hi all,

Do you know if it's possible to duplicate an exclusion set?

I'm troubleshooting an issue and need to duplicate the standard exclusion set to make some changes.

There are a lot of individual exclusions so I would rather not do this manually.

Anybody know if this can be done?

Thanks,

Matt.

[Matthew Franks · Accepted solution]

Matt,

There is a Feature Request in to allow this from the user side but currently the only option is to open a TAC case to have one of our Developers duplicate the list for you.  Please contact your Account Manager so they can add your request to the current Feature Request to give it more visibility.

Thanks,

Matt

[matty-boy]

Thank you for the info Matthew.

[jeaorozc]

For future reference:

Customer may now use Cisco Secure Endpoint APIs to accomplish the same.

You may use a GET exclusion set to download the exclusion set you'd like to duplicate.

Then, you can use POST to create a new exclusion set. 

Check out the available Exclusion related APIs here: https://developer.cisco.com/docs/secure-endpoint/#!exclusions

There is also a script in Cisco's public github to export Exclusions:

https://github.com/CiscoSecurity/amp-04-export-exclusions

Regards,

Jean Orozco Navarro

Technical Consulting Engineer, Secure Endpoint

[Matthew Franks]

While the export exclusions script can help you export each of your exclusions, you would then have to manually add them.  I've created a new script that will duplicate a list for you.
https://github.com/mafranks/duplicate_exclusions_list
The exception with this is that Threat type exclusions are currently not exported so they won't be duplicated and you will have to add those manually.  I've put in a request to have this added to the API functionality so hopefully I can get that updated in the near future.
Hope that helps!

-Matt