AMP

Uses CISCO AMP Endpoint.

Endpoint · Cisco AMP

Details

IDAMP
ProviderCisco Systems
CategoryEndpoint
From Version5.0.0
Supported ModulesAgentix XSIAM

README

Uses CISCO AMP Endpoint
This integration was integrated and tested with API version v1 of AMP

Configure AMP on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for AMP.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Server URL (e.g. https://api.amp.cisco.com)
    • Client ID
    • Trust any certificate (not secure)
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. amp_get_computers
  2. amp_get_computer_by_connector
  3. amp_get_computer_trajctory
  4. amp_move_computer
  5. amp_get_computer_activity
  6. amp_get_events
  7. amp_get_event_types
  8. amp_get_application_blocking
  9. amp_get_file_list_by_guid
  10. amp_get_simple_custom_detections
  11. amp_get_file_list_files
  12. amp_get_file_list_files_by_sha
  13. amp_set_file_list_files_by_sha
  14. amp_delete_file_list_files_by_sha
  15. amp_get_groups
  16. amp_get_group
  17. amp_set_group_policy
  18. amp_get_policies
  19. amp_get_policy
  20. amp_get_version
  21. amp_delete_computers_isolation
  22. amp_put_computers_isolation
  23. amp_get_computers_isolation

1. amp_get_computers

Returns a list of computers on which agents are deployed. You can use filters (arguments) to narrow the search.

Base Command

amp_get_computers

Input
Argument Name Description Required
limit Maximum number of results to return. Optional
hostname Filter results by hostname. Optional
internal_ip Filter results by internal IP address. Optional
external_ip Filter results by external IP address. Optional
group_guid Filter results by group GUID. Optional
Context Output

There is no context output for this command.

Command Example
 !amp_get_computers limit=10 hostname='demisto.com'

2. amp_get_computer_by_connector

Returns information for the specified computer.

Base Command

amp_get_computer_by_connector

Input
Argument Name Description Required
connector_guid The connector GUID for which to return information. Required
Command Example
!amp_get_computer_by_connector connector_guid=12345abcde

3. amp_get_computer_trajctory

Returns a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP Console. Use the Q argument to search for an IP address, SHA256 hash, or URL.

Base Command

amp_get_computer_trajctory

Input
Argument Name Description Required
q The IP address, SHA256 hash, or URL. Optional
limit Maximum number of results to return. Optional
connector_guid The connector GUID. Required
Command Example
!amp_get_computer_trajctory q='8.8.8.8' limit=10 connector_guid=12345abdce

4. amp_move_computer

Moves a computer to a group with the corresponding connector_guid and group_guid, respectively.

Base Command

amp_move_computer

Input
Argument Name Description Required
connector_guid The connector GUID. Required
group_guid The group GUID. Required
Command Example
!amp_move_computer connector_guid='abcde12345' group_guid='demisto123'

5. amp_get_computer_activity

This endpoint enables you to search all computers across your organization for any events or activities associated with a file or network operation, and returns computers that match the specified criteria. You can then query the /computers/{connector-guid}/trajectory endpoint for specific details.

Base Command

amp_get_computer_activity

Input
Argument Name Description Required
q An IPv4 address, SHA256 hash, filename, or URL fragment. Required
limit Maximum number of results to return. Optional
offset offset Optional
Context Output

There is no context output for this command.

Command Example
!amp_get_computer_activity q='8.8.8.8'

6. amp_get_events

A general query interface for events. This is analogous to the Events view on the FireAMP Console.

Base Command

amp_get_events

Input
Argument Name Description Required
limit Maximum number of results to return. Optional
connector_guid The connector GUID. Optional
group_guid The group GUID. Optional
detection_sha256 The detected SHA256 hash. Optional
application_sha256 The application SHA256. Optional
event_type The event type. Optional
offset The offset. Optional
start_date The start date for the query, in ISO8601 format. Optional
Context Output

There is no context output for this command.

Command Example
!amp_get_events connector_guid='abcde12345'

7. amp_get_event_types

Events are identified and filtered by a unique ID. This endpoint provides a human readable name and short description of each event (by ID).

Base Command

amp_get_event_types

Input

There is no input for this command.

Context Output

There is no context output for this command.

Command Example
!amp_get_event_types

8. amp_get_application_blocking

Returns a list of application blocking file lists. You can filter this list by name

Base Command

amp_get_application_blocking

Input
Argument Name Description Required
limit Maximum number of results to return. Optional
offset The offset. Optional
name Name of the file. Optional
Context Output

There is no context output for this command.

Command Example
!amp_get_application_blocking name='abcde12345'

9. amp_get_file_list_by_guid

Returns a particular file list for application blocking or simple custom detection. You need to specify the file_list_guid argument to retrieve information about a particular file_list.

Base Command

amp_get_file_list_by_guid

Input
Argument Name Description Required
file_list_guid Retrieves information about a particular file_list. Required
Context Output

There is no context output for this command.

Command Example
!amp_get_file_list_by_guid file_list_guid='abcde12345'

10. amp_get_simple_custom_detections

Returns a list of simple custom detection file lists. You can filter this list by detection name.

Base Command

amp_get_simple_custom_detections

Input
Argument Name Description Required
limit Maximum number of results to return. Optional
offset The offset. Optional
name Name of the detection. Optional
Context Output

There is no context output for this command.

Command Example
!amp_get_simple_custom_detections name='sample detections'

11. amp_get_file_list_files

Returns a list of items for a particular file_list. You need to specify the file_list_guid argument to retrieve these items.

Base Command

amp_get_file_list_files

Input
Argument Name Description Required
limit Maximum number of results to return. Optional
offset The offset. Optional
file_list_guid Retrieves information about a particular file_list. Required
Context Output

There is no context output for this command.

Command Example
!amp_get_file_list_files file_list_guid='abcde12345'

12. amp_get_file_list_files_by_sha

Returns a particular item for a given file_list. You need to specify the sha256 argument and the file_list_guid argument to retrieve an item.

Base Command

amp_get_file_list_files_by_sha

Input
Argument Name Description Required
file_list_guid Retrieves information about a particular file_list. Required
sha256 SHA256 hash. Required
Context Output

There is no context output for this command.

Command Example
!amp_get_file_list_files_by_sha file_list_guid='abcde12345' sha256='samplesha256'

13. amp_set_file_list_files_by_sha

Adds a SHA256 hash to a file list, using file_list_guid.

Base Command

amp_set_file_list_files_by_sha

Input
Argument Name Description Required
file_list_guid Retrieves information about a particular file_list. Required
sha256 SHA256 hash. Required
description Description of the SHA256 hash. Optional
Context Output

There is no context output for this command.

Command Example
!amp_set_file_list_files_by_sha file_list_guid='abcde12345' sha256='samplesha256' description='This is a sample SHA'

14. amp_delete_file_list_files_by_sha

Deletes an item from a file_list using the SHA256 hash and file_list_guid.

Base Command

amp_delete_file_list_files_by_sha

Input
Argument Name Description Required
file_list_guid The file_list_guid to retrieve information about a particular file_list Required
sha256 SHA256 hash. Required
Context Output

There is no context output for this command.

Command Example
!amp_delete_file_list_files_by_sha file_list_guid='abcde12345' sha256='samplesha256'

15. amp_get_groups

Returns basic information about groups in your organization. You can map group names to GUIDs for filtering on the events endpoint.

Base Command

amp_get_groups

Input
Argument Name Description Required
limit amount of results Optional
name name of the group Optional
Context Output

There is no context output for this command.

Command Example
!amp_get_groups limit=25

16. amp_get_group

Returns a particular group

Base Command

amp_get_group

Input
Argument Name Description Required
group_guid The particular group guid Required
Context Output

There is no context output for this command.

Command Example
!amp_get_group group_guid='abcde12345'

17. amp_set_group_policy

Sets a security policy to a group of endpoints.

Base Command

amp_set_group_policy

Input
Argument Name Description Required
group_guid The group GUID. Required
linux_policy_guid The Linux policy guide. Optional
android_policy_guid The Android policy guide. Optional
mac_policy_guid The Mac policy guide. Optional
windows_policy_guid The Windows policy guide. Optional
Context Output

There is no context output for this command.

Command Example
!amp_set_group_policy group_guid='abcde12345'

18. amp_get_policies

Returns a list of policies. You can filter this list by name and product.

Base Command

amp_get_policies

Input
Argument Name Description Required
limit Maximum number of results to return. Optional
offset The offset. Optional
name The policy name. Optional
product The policy product. Optional
Context Output

There is no context output for this command.

Command Example
!amp_get_policies name='TestPolicy'

19. amp_get_policy

Retrieves information about a particular policy, based on policy_guid.

Base Command

amp_get_policy

Input
Argument Name Description Required
policy_guid The policy GUID. Required
Context Output

There is no context output for this command.

Command Example
!amp_get_policy policy_guid='abcde12345'

20. amp_get_version

Fetches a list of versions.

Base Command

amp_get_version

Input

There is no input for this command.

Context Output

There is no context output for this command.

Command Example
!amp_get_version

21. amp_delete_computers_isolation

Request to unlock an isolated computer. Can also be used as a course-grained isolation status request.

Base Command

amp_delete_computers_isolation

Input
Argument Name Description Required
connector_guid connector GUID. Required
unlock_code Comment about unlocking the computer. Use the amp_get_computers_isolation command to retrieve the unlock_code. Optional
Context Output

There is no context output for this command.

Command Example
!amp_delete_computers_isolation connector_guid=12345abcde

22. amp_put_computers_isolation

Requests isolation for a Computer. If a computer is already isolated a 409 conflict error status is returned.

Base Command

amp_put_computers_isolation

Input
Argument Name Description Required
connector_guid connector GUID. Required
unlock_code Comment used when locking the computer. Use the amp_get_computers_isolation command to retrieve the unlock_code. Optional
Context Output

There is no context output for this command.

Command Example
!amp_put_computers_isolation connector_guid=12345abcde

23. amp_get_computers_isolation

Returns a fine grained isolation status for a computer.

Base Command

amp_get_computers_isolation

Input
Argument Name Description Required
connector_guid connector GUID. Required
status The status of the computer. Can be: “not_isolated”, “pending_start”, “isolated”, or “pending_stop”. Optional
Context Output

There is no context output for this command.

Command Example
!amp_get_computers_isolation connector_guid=12345abcde

Configuration parameters

  • server — Server URL (e.g. https://api.amp.cisco.com) (required)
  • credentials — Client ID (required)
  • insecure — Trust any certificate (not secure)

Commands (25)

  • amp_delete_computers_isolation

    Performs a feature availability request on a computer. Can also be used as a course-grained isolation status request.

  • amp_delete_file_list_files_by_sha

    Deletes an item from a file_list using the SHA256 hash and file_list_guid.

  • amp_get_application_blocking

    Returns a list of application blocking file lists. You can filter this list by name

  • amp_get_computer_activity

    This endpoint enables you to search all computers across your organization for any events or activities associated with a file or network operation, and returns computers that match the specified criteria. You can then query the /computers/{connector-guid}/trajectory endpoint for specific details.

  • amp_get_computer_actvity Deprecated

    This endpoint enables you to search all computers across your organization for any events or activities associated with a file or network operation, and returns computers that match the specified criteria. You can then query the /computers/{connector-guid}/trajectory endpoint for specific details.

  • amp_get_computer_by_connector

    Returns information for the specified computer.

  • amp_get_computer_trajctory Deprecated

    Returns a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP Console. Use the Q argument to search for an IP address, SHA256 hash, or URL.

  • amp_get_computer_trajectory

    Returns a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP Console. Use the Q argument to search for an IP address, SHA256 hash, or URL.

  • amp_get_computers

    Returns a list of computers on which agents are deployed. You can use filters (arguments) to narrow the search.

  • amp_get_computers_isolation

    Returns a fine grained isolation status for a computer. The available flag is set to true if isolation can be performed on the computer. status will be set to one of: not_isolated pending_start isolated pending_stop

  • amp_get_event_types

    Events are identified and filtered by a unique ID. This endpoint provides a human readable name and short description of each event (by ID).

  • amp_get_events

    A general query interface for events. This is analogous to the Events view on the FireAMP Console.

  • amp_get_file_list_by_guid

    Returns a particular file list for application blocking or simple custom detection. You need to specify the file_list_guid argument to retrieve information about a particular file_list.

  • amp_get_file_list_files

    Returns a list of items for a particular file_list. You need to specify the file_list_guid argument to retrieve these items.

  • amp_get_file_list_files_by_sha

    Returns a particular item for a given file_list. You need to specify the sha256 argument and the file_list_guid argument to retrieve an item.

  • amp_get_group

    Returns a particular group

  • amp_get_groups

    Returns basic information about groups in your organization. You can map group names to GUIDs for filtering on the events endpoint.

  • amp_get_policies

    Returns a list of policies. You can filter this list by name and product.

  • amp_get_policy

    Retrieves information about a particular policy, based on policy_guid.

  • amp_get_simple_custom_detections

    Returns a list of simple custom detection file lists. You can filter this list by detection name.

  • amp_get_version

    Fetches a list of versions.

  • amp_move_computer

    Moves a computer to a group with the corresponding connector_guid and group_guid, respectively.

  • amp_put_computers_isolation

    Request Isolation for a Computer. If a computer is already isolated a 409 Conflict error status will be sent. Returns the same result of a GET request on the /isolation endpoint.

  • amp_set_file_list_files_by_sha

    Adds a SHA256 hash to a file list, using file_list_guid.

  • amp_set_group_policy

    Sets a security policy to a group of endpoints.

Source

AMP.js AMP.yml AMP_description.md
Download History Raw 
var username = params.credentials.identifier;
var password = params.credentials.password;
var server = params.server;
var insecure = params.insecure;

var fixArgs = function(command, args) {
    var newArgs = {};
    if (args) {
        var keys = Object.keys(args);
        for (var i = 0; i<keys.length; i++) {
            newArgs[fixBracketsArgs(command, keys[i])] = args[keys[i]];
        }
    }
    return newArgs;
};

var sendRequest = function(method, url, queryName, body) {
    var res = http(
            url,
            {
                Method: method,
                Username: username,
                Password: password,
                Body: body,
                Headers: {
                    'accept': ['application/json'],
                    'content-type': ['application/json'],
                },
            },
            insecure
        );
    if (res.StatusCode < 200 || res.StatusCode >= 300) {
        throw 'Failed to ' + queryName + ', request status code: ' + res.StatusCode + ' and Body: ' + res.Body + '.';
    }
    return res.Body;
}

var methodDict = {
    'amp_delete_computers_isolation': 'DELETE',
    'amp_put_computers_isolation': 'PUT',
    'amp_get_computers_isolation': 'GET',
    'amp_get_computers': 'GET',
    'amp_get_computer_by_connector': 'GET',
    'amp_get_computer_trajctory': 'GET',
    'amp_move_computer': 'PATCH',
    'amp_get_computer_actvity': 'GET',
    'amp_get_events': 'GET',
    'amp_get_event_types': 'GET',
    'amp_get_application_blocking': 'GET',
    'amp_get_file_list_by_guid': 'GET',
    'amp_get_simple_custom_detections': 'GET',
    'amp_get_file_list_files': 'GET',
    'amp_get_file_list_files_by_sha': 'GET',
    'amp_set_file_list_files_by_sha': 'POST',
    'amp_delete_file_list_files_by_sha': 'DELETE',
    'amp_get_groups': 'GET',
    'amp_get_group': 'GET',
    'amp_set_group_policy': 'PATCH',
    'amp_get_policies': 'GET',
    'amp_get_policy': 'GET',
    'amp_get_version': 'GET',
}

var urlDict = {
    'amp_delete_computers_isolation':'/v1/computers',
    'amp_put_computers_isolation':'/v1/computers',
    'amp_get_computers_isolation':'/v1/computers',
    'amp_get_computers': '/v1/computers',
    'amp_get_computer_by_connector': '/v1/computers',
    'amp_get_computer_trajctory': '/v1/computers',
    'amp_move_computer': '/v1/computers',
    'amp_get_computer_actvity': '/v1/computers/activity',
    'amp_get_events': '/v1/events',
    'amp_get_event_types': '/v1/event_types',
    'amp_get_application_blocking': '/v1/file_lists/application_blocking',
    'amp_get_file_list_by_guid': '/v1/file_lists',
    'amp_get_simple_custom_detections': '/v1/file_lists/simple_custom_detections',
    'amp_get_file_list_files': '/v1/file_lists',
    'amp_get_file_list_files_by_sha': '/v1/file_lists',
    'amp_set_file_list_files_by_sha': '/v1/file_lists',
    'amp_delete_file_list_files_by_sha': '/v1/file_lists',
    'amp_get_groups': '/v1/groups',
    'amp_get_group': '/v1/groups',
    'amp_set_group_policy': '/v1/groups',
    'amp_get_policies': '/v1/policies',
    'amp_get_policy': '/v1/policies',
    'amp_get_version': '/v1/version',
}

var getURL = function(command, args) {
    var base = urlDict[command];
    switch (command) {

        case 'amp_delete_computers_isolation':
            base += '/' + args['connector_guid'] + '/isolation';
            delete args['connector_guid'];
            break;
        case 'amp_put_computers_isolation':
            base += '/' + args['connector_guid'] + '/isolation';
            delete args['connector_guid'];
            break;
        case 'amp_get_computers_isolation':
            base += '/' + args['connector_guid'] + '/isolation';
            delete args['connector_guid'];
            break;
        case 'amp_move_computer':
            base += '/' + args['connector_guid'];
            delete args['connector_guid'];
            break;
        case 'amp_get_computer_by_connector':
            base += '/' + args['connector_guid'];
            delete args['connector_guid'];
            break;
        case 'amp_get_computer_trajctory':
            base += '/' + args['connector_guid'] + '/trajectory';
            delete args['connector_guid'];
            break;
        case 'amp_get_file_list_by_guid':
            base += '/' + args['file_list_guid'];
            delete args['file_list_guid'];
            break;
        case 'amp_get_file_list_files':
            base += '/' + args['file_list_guid'] + '/files';
            delete args['file_list_guid'];
            break;
        case 'amp_set_file_list_files_by_sha':
        case 'amp_get_file_list_files_by_sha':
        case 'amp_delete_file_list_files_by_sha':
            base += '/' + args['file_list_guid'] + '/files/' + args['sha256'];
            delete args['file_list_guid'];
            delete args['sha256'];
            break;
        case 'amp_get_group':
        case 'amp_set_group_policy':
            base += '/' + args['group_guid'];
            delete args['group_guid'];
            break;
        case 'amp_get_policy':
            base += '/' + args['policy_guid'];
            delete args['policy_guid'];
            break;
    }
    return base
}

var bracketsArgs = [
    'group_guid',
    'hostname',
    'connector_guid',
    'event_type',
    'name',
    'product'
    ];

var fixBracketsArgs = function(command, arg) {
    if (bracketsArgs.indexOf(arg) !== -1) {
        if (command !== 'amp_get_groups') {
            return arg + '[]';
        }
    }
    return arg;
}

var encodeBody = function(args) {
    if (args) {
        return JSON.stringify(args);
    }
    return undefined;
}

function exeCommand(command, cmdArgs) {
    var method = methodDict[command];
    var url = getURL(command, cmdArgs);
    var query = '';
    var body = '';
    if (method === 'GET') {
        query = encodeToURLQuery(fixArgs(command, cmdArgs));
    } else {
        body = encodeBody(cmdArgs);
    }
    var res = sendRequest(
        method,
        server + url + query,
        urlDict[command],
        body
    );
    return res;
}

// Fixing commands names
if (command === 'amp_get_computer_trajectory'){
  command = 'amp_get_computer_trajctory';
}
else if (command === 'amp_get_computer_activity'){
  command = 'amp_get_computer_actvity';
}
switch (command) {
    case 'test-module':
        exeCommand('amp_get_version', args);
        // successful response
        return 'ok';
    default:
        return exeCommand(command, args);
}