Configuration parameters
server— Server URL (e.g. https://api.amp.cisco.com) (required)credentials— Client ID (required)insecure— Trust any certificate (not secure)
Commands (25)
-
amp_delete_computers_isolationPerforms a feature availability request on a computer. Can also be used as a course-grained isolation status request.
-
amp_delete_file_list_files_by_shaDeletes an item from a file_list using the SHA256 hash and file_list_guid.
-
amp_get_application_blockingReturns a list of application blocking file lists. You can filter this list by name
-
amp_get_computer_activityThis endpoint enables you to search all computers across your organization for any events or activities associated with a file or network operation, and returns computers that match the specified criteria. You can then query the /computers/{connector-guid}/trajectory endpoint for specific details.
-
amp_get_computer_actvityDeprecatedThis endpoint enables you to search all computers across your organization for any events or activities associated with a file or network operation, and returns computers that match the specified criteria. You can then query the /computers/{connector-guid}/trajectory endpoint for specific details.
-
amp_get_computer_by_connectorReturns information for the specified computer.
-
amp_get_computer_trajctoryDeprecatedReturns a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP Console. Use the Q argument to search for an IP address, SHA256 hash, or URL.
-
amp_get_computer_trajectoryReturns a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP Console. Use the Q argument to search for an IP address, SHA256 hash, or URL.
-
amp_get_computersReturns a list of computers on which agents are deployed. You can use filters (arguments) to narrow the search.
-
amp_get_computers_isolationReturns a fine grained isolation status for a computer. The available flag is set to true if isolation can be performed on the computer. status will be set to one of: not_isolated pending_start isolated pending_stop
-
amp_get_event_typesEvents are identified and filtered by a unique ID. This endpoint provides a human readable name and short description of each event (by ID).
-
amp_get_eventsA general query interface for events. This is analogous to the Events view on the FireAMP Console.
-
amp_get_file_list_by_guidReturns a particular file list for application blocking or simple custom detection. You need to specify the file_list_guid argument to retrieve information about a particular file_list.
-
amp_get_file_list_filesReturns a list of items for a particular file_list. You need to specify the file_list_guid argument to retrieve these items.
-
amp_get_file_list_files_by_shaReturns a particular item for a given file_list. You need to specify the sha256 argument and the file_list_guid argument to retrieve an item.
-
amp_get_groupReturns a particular group
-
amp_get_groupsReturns basic information about groups in your organization. You can map group names to GUIDs for filtering on the events endpoint.
-
amp_get_policiesReturns a list of policies. You can filter this list by name and product.
-
amp_get_policyRetrieves information about a particular policy, based on policy_guid.
-
amp_get_simple_custom_detectionsReturns a list of simple custom detection file lists. You can filter this list by detection name.
-
amp_get_versionFetches a list of versions.
-
amp_move_computerMoves a computer to a group with the corresponding connector_guid and group_guid, respectively.
-
amp_put_computers_isolationRequest Isolation for a Computer. If a computer is already isolated a 409 Conflict error status will be sent. Returns the same result of a GET request on the /isolation endpoint.
-
amp_set_file_list_files_by_shaAdds a SHA256 hash to a file list, using file_list_guid.
-
amp_set_group_policySets a security policy to a group of endpoints.