What is the difference between Cisco Secure Endpoint(AMP) and EDR ?

[junaid-rehman]

Hi Everyone,

I’m posting this to understand the key differences between Cisco Secure Endpoint (CSE) and Cisco EDR.

We’re currently trying to integrate Cisco Secure AMP with our third-party monitoring and ticketing system. During this process, we discovered that "Cisco EDR supports webhooks, which allows integration with HaloPSA for ticket generation. However, at the moment, we only have Cisco AMP, which unfortunately doesn’t support webhooks."

Could someone explain the basic and straightforward differences between EDR and CSE?

Thanks in advance!

[Ken Stieers · Accepted solution]

Looks like that's a quote from somewhere, do they mean Cisco XDR?

AMP is Cisco's 'EDR' product.

XDR is the platform product that contains Automation that can call webhooks as part of workflows you write.

[junaid-rehman]

Thank you @Ken Stieers 

Is there any way to automate and call webhooks from Cisco EDR (AMP) to integrate with a third-party ticketing system for generating tickets?

[Ken Stieers]

As far as I know, no... and there's no reference to "webhook" in the help or API docs.
You CAN create an event filter and subscribe to it and send it to an email account that the ticketing system can create a ticket from.

[junaid-rehman]

Thank you for your response.

Understood. I have one more query: Is it possible to add the same user to multiple organizations? For example, can a user with the email abc@xyz.com be added to multiple organizations?

[Matthew Franks · Accepted solution]

A user can be part of many organizations. An administrator from each one can send an invitation. When logging in, the user would be prompted to select which organization to log in to.

-Matt