Does Endpoint AMP send syslog event ?

[peter.peng]

Hi Sir:

    Does Endpoint AMP send syslog event  or send the log by any methods ?

[David Janulik]

Hello,

AMP agent sends events to AMP console, for further details. The typical Syslog is not paired in any way with AMP agent. If Security Operation wants such output, need to use API. With REST API you are able to pull data, or run them regulary using e.g. cron jobs.

Hope that answers your question

David

[AlexPi]

I think this is what you need: Overview of the Cisco AMP for Endpoints API

[jefburke]

Hi Peter,

Neil and Evgeny have an Endpoint Security Ask The Expert thread going right now. It has a good focus on AMP. You should try posting this question and others there!

Here is the link: https://community.cisco.com/t5/advanced-threats/ask-the-expert-endpoint-security-the-daunting-challenges-of-the/td-p/3736946

I may not be able to help much, be he can!

[peter.peng]

Hi Jefburke:

    OK, Thanks for your help.