AMP

Uses CISCO AMP Endpoint.

Category: Endpoint
Pack: AMP

Configuration parameters

server — Server URL (e.g. https://api.amp.cisco.com) (required)
credentials — Client ID (required)
insecure — Trust any certificate (not secure)

Commands (25)

amp_delete_computers_isolation — Performs a feature availability request on a computer. Can also be used as a course-grained isolation status request.
amp_delete_file_list_files_by_sha — Deletes an item from a file_list using the SHA256 hash and file_list_guid.
amp_get_application_blocking — Returns a list of application blocking file lists. You can filter this list by name
amp_get_computer_activity — This endpoint enables you to search all computers across your organization for any events or activities associated with a file or network operation, and returns computers that match the specified criteria. You can then query the /computers/{connector-guid}/trajectory endpoint for specific details.
amp_get_computer_actvity — This endpoint enables you to search all computers across your organization for any events or activities associated with a file or network operation, and returns computers that match the specified criteria. You can then query the /computers/{connector-guid}/trajectory endpoint for specific details.
amp_get_computer_by_connector — Returns information for the specified computer.
amp_get_computer_trajctory — Returns a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP Console. Use the Q argument to search for an IP address, SHA256 hash, or URL.
amp_get_computer_trajectory — Returns a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP Console. Use the Q argument to search for an IP address, SHA256 hash, or URL.
amp_get_computers — Returns a list of computers on which agents are deployed. You can use filters (arguments) to narrow the search.
amp_get_computers_isolation — Returns a fine grained isolation status for a computer. The available flag is set to true if isolation can be performed on the computer. status will be set to one of: not_isolated pending_start isolated pending_stop
amp_get_event_types — Events are identified and filtered by a unique ID. This endpoint provides a human readable name and short description of each event (by ID).
amp_get_events — A general query interface for events. This is analogous to the Events view on the FireAMP Console.
amp_get_file_list_by_guid — Returns a particular file list for application blocking or simple custom detection. You need to specify the file_list_guid argument to retrieve information about a particular file_list.
amp_get_file_list_files — Returns a list of items for a particular file_list. You need to specify the file_list_guid argument to retrieve these items.
amp_get_file_list_files_by_sha — Returns a particular item for a given file_list. You need to specify the sha256 argument and the file_list_guid argument to retrieve an item.
amp_get_group — Returns a particular group
amp_get_groups — Returns basic information about groups in your organization. You can map group names to GUIDs for filtering on the events endpoint.
amp_get_policies — Returns a list of policies. You can filter this list by name and product.
amp_get_policy — Retrieves information about a particular policy, based on policy_guid.
amp_get_simple_custom_detections — Returns a list of simple custom detection file lists. You can filter this list by detection name.
amp_get_version — Fetches a list of versions.
amp_move_computer — Moves a computer to a group with the corresponding connector_guid and group_guid, respectively.
amp_put_computers_isolation — Request Isolation for a Computer. If a computer is already isolated a 409 Conflict error status will be sent. Returns the same result of a GET request on the /isolation endpoint.
amp_set_file_list_files_by_sha — Adds a SHA256 hash to a file list, using file_list_guid.
amp_set_group_policy — Sets a security policy to a group of endpoints.