cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2163
Views
10
Helpful
1
Replies

Cisco AMP - auto assign a device to a group upon device registration

Kombi
Level 1
Level 1

Question One - Is there a way to have devices auto assign to a group based on a partial name of that device ? 

 

Example 1 - If we have a node called "worker-LT" - I want this laptop auto assigned to our laptop group based on a partial  name of " -LT" .

 

Example 2 - we have servers that name contain letters such as erp, prd, sup, stx, sdk in the server name.  Is there a way to have multiple partial names of a node assigned to a group? 

 

Question two - Is there a way to decommission a node automatically if it has not check in for 24 hrs? 

- We have a lot of Dockers that get built and torn down on a regular bases that we want to be able to reclaim the AMP license automatically base on a check in time for a certain group or policy.

 

1 Accepted Solution

Accepted Solutions

Troja007
Cisco Employee
Cisco Employee

Hello @Kombi ,

enclosed the infos i have....

 

Q1: sorry to say, there is not built in feature in AMP to sort Computer automatically to groups. There is a script template available to move computers to a group, this may help: https://github.com/CiscoSecurity/amp-04-group-membership

 

Q2: you can use a script from GitHub to delete inactive computers: amp-04-delete-stale-guids

 

There is a FR open for both features, but today no ETA. I added your post to the FRs.

Greetings,

Thorsten

View solution in original post

1 Reply 1

Troja007
Cisco Employee
Cisco Employee

Hello @Kombi ,

enclosed the infos i have....

 

Q1: sorry to say, there is not built in feature in AMP to sort Computer automatically to groups. There is a script template available to move computers to a group, this may help: https://github.com/CiscoSecurity/amp-04-group-membership

 

Q2: you can use a script from GitHub to delete inactive computers: amp-04-delete-stale-guids

 

There is a FR open for both features, but today no ETA. I added your post to the FRs.

Greetings,

Thorsten

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: