How to query one group in AMP for an IP Address

[tom.power1]

Hi,

In response to a security incident, I would like to query one group of endpoints in AMP (Secure Endpoint) for network connections to a specific IP address.

How can I do that in Orbital?

Thanks for your time.

Have a great day.
T

[nazi.farhadi3171]

Thanks for the information, keep sharing this type of info  Marriott Global Source Login

[JennieZhang]

hello,

as per my understanding, you have an IP address and you want to find out which endpoints has connected to that IP address, is my understanding correct?

have you tried using Threat Response to investigate the IP address?

https://visibility.apjc.amp.cisco.com/

Threat response can investigate on IP addresses, domains, URLs... you can open Threat Response and paste the IP address in the top field and then click 'investigate'.

[Troja007]

Hello @tom.power1 ,
if I understand right, you want to query a group... e.g. like, select a group of endpoints defined in Secure Endpoint, and starting a query for these endpoint only, right?

If I´m not totally wrong, some work is done in this direction. You may ping your Cisco representative for an official statement.

Greetings,
Thorsten