CiscoAMP Deprecated

Retrieve app_trajectory queries for a given IOS bundle ID.

Fetch a list of computers that have observed files with a given file name. Provides the ability to search all computers across an organization for any events or activities associated with a file or network operation, and returns computers matching those criteria. There is a hard limit of 5000 historical entries searched.

Deletes a specific computer with given connector_guid.

Request isolation for a computer. Supports polling. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.

Request isolation stop for a computer. Supports polling. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.

Performs a feature availability request on a computer. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.

Returns a fine-grained isolation status for a computer. The available flag is set to true if isolation can be performed on the computer. Status will be set to one of - not_isolated, pending_start, isolated and pending_stop. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.

Fetch computers to show information about them. Can be filtered by a variety of criteria.

Moves a computer to a group with the given connector_guid and group_guid.

Provides a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP console.

Fetch a list of computers that have observed activity by the given username.

Fetch a specific computer's trajectory with a given connector GUID and filter for events with user name activity.

Provides a list of vulnerabilities observed on a specific computer. The vulnerabilities can be filtered to show only vulnerable applications observed for a specific time range.

Fetch a list of events that can be filtered by a variety of criteria. Each criteria type is logically ANDed with the other criteria, and each selection of a criteria is logically ORed. This is analogous to the Events view on the FireAMP Console.

Fetches a list of event types. Events are identified and filtered by a unique ID.

Creates a file list item with a given SHA-256 for a specific file list with a given file_list_guid.

Deletes a file list item with a given SHA-256 and associated to a file list with a given file_list_guid.

Returns a list of items for a particular file_list. file_list_guid must be provided to retrieve these items. A particular item can be returned by providing a SHA-256.

Returns a particular file list for application blocking or simple custom detection. file_list_guid must be provided to retrieve information about a particular file_list. Can fetch an application_blocking or simple_custom_detection file list. Defaults to application_blocking.

Creates a new group along with a group name or description.

Destroys a group with a given GUID.

Provides information about groups in an organization.

Converts an existing group to a child of another group or an existing child group to a root group (that is, one with no parent groups).

Updates a group to a given policy and returns all the policies in that group.

Show information about indicators.

Gets information about policies by filtering with a product and name of a specific policy with a policy_guid.

Get API version.

Fetch a list of vulnerabilities. This is analogous to the Vulnerable Software view on the AMP for Endpoints Console. The list can be filtered to show only the vulnerable programs detected for a specific time range. Provide a list of computers on which the vulnerability has been observed with given SHA-256. The list item contains a summary of information on the vulnerability, including: application name and version, SHA-256 value for the executable file, connectors on which the vulnerable application was observed and the most recent CVSS score. IMPORTANT: computers key returns information about the last 1000 Connectors on which the vulnerable application was observed.

Returns information about an endpoint.

Runs reputation on files.