CiscoAMPEventCollector

This is the Cisco AMP event collector integration for Cortex XSIAM.

Category

Analytics & SIEM

Pack

AMP

Configuration parameters

• url — Server URL (e.g., https://url.com) (required)
• credentials — Client ID (required)
• max_events_per_fetch — Max events per fetch
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (1)

• cisco-amp-get-events — Gets events from Cisco AMP.