category: Endpoint provider: Cisco Systems sectionorder: - Connect - Collect commonfields: id: AMPv2 version: -1 configuration: - defaultvalue: https://api.amp.cisco.com display: Server URL name: server_url required: true type: 0 section: Connect - display: Third Party API Client ID name: credentials required: true displaypassword: API Key type: 9 section: Connect - defaultvalue: 'false' display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 section: Collect - defaultvalue: 'false' display: Use system proxy settings name: proxy type: 8 required: false section: Connect - additionalinfo: Maximum number of incidents per fetch. The maximum is 200. defaultvalue: 50 display: Maximum incidents to fetch. name: max_fetch type: 0 required: false section: Collect - defaultvalue: 'false' display: Fetch incidents with severity = null name: include_null_severities type: 8 required: false section: Collect - display: Incident severity to fetch. name: incident_severities options: - Low - Medium - High - Critical type: 16 required: false section: Collect - defaultvalue: 3 days display: First fetch time additionalinfo: First alert created date to fetch. e.g., "1 min ago","2 weeks ago","3 months ago" name: first_fetch type: 0 required: false section: Collect - display: Event types name: event_types additionalinfo: Comma-separated list of event type IDs. The IDs can be retrieved from the cisco-amp-event-type-list command. type: 0 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - defaultvalue: 'true' additionalinfo: Create relationships between indicators as part of Enrichment. display: Create relationships name: create_relationships type: 8 required: false section: Collect description: Cisco Advanced Malware Protection software is designed to prevent, detect, and help remove threats in an efficient manner from computer systems. Threats can take the form of software viruses and other malware such as ransomware, worms, Trojans, spyware, adware, and fileless malware. display: Cisco AMP v2 name: AMPv2 script: commands: - arguments: - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit - description: The connector GUID for a specific computer. name: connector_guid - description: Comma-separated list of host names to filter by (has auto complete capabilities). isArray: true name: hostname - description: Internal IP to filter by. name: internal_ip - description: External IP to filter by. name: external_ip - description: Comma-separated list of group GUIDs to filter by. isArray: true name: group_guid - description: Time range to filter by. name: last_seen_within - description: Time range to filter over by. name: last_seen_over description: Fetch computers to show information about them. Can be filtered by a variety of criteria. name: cisco-amp-computer-list outputs: - type: String contextPath: CiscoAMP.Computer.connector_guid description: GUID of the connector. - type: String contextPath: CiscoAMP.Computer.hostname description: Host's name. - type: String contextPath: CiscoAMP.Computer.windows_processor_id description: Windows processor ID. - type: Boolean contextPath: CiscoAMP.Computer.active description: Whether the computer is active. - type: String contextPath: CiscoAMP.Computer.connector_version description: Version of the connector. - type: String contextPath: CiscoAMP.Computer.operating_system description: Operating system of the computer. - type: String contextPath: CiscoAMP.Computer.os_version description: Operating system version. - type: String contextPath: CiscoAMP.Computer.internal_ips description: List of internal IPs. - type: String contextPath: CiscoAMP.Computer.external_ip description: External IP. - type: String contextPath: CiscoAMP.Computer.group_guid description: GUID of the group. - type: Date contextPath: CiscoAMP.Computer.install_date description: Installation date. - type: Boolean contextPath: CiscoAMP.Computer.is_compromised description: Whether the computer is compromised. - type: Boolean contextPath: CiscoAMP.Computer.demo description: Whether the computer is a demo. - type: String contextPath: CiscoAMP.Computer.network_addresses.mac description: List of MAC addresses. - type: String contextPath: CiscoAMP.Computer.network_addresses.ip description: List of IP addresses. - type: String contextPath: CiscoAMP.Computer.policy.guid description: GUID of the policy. - type: String contextPath: CiscoAMP.Computer.policy.name description: Name of the policy. - type: String contextPath: CiscoAMP.Computer.groups.guid description: GUID of the group. - type: String contextPath: CiscoAMP.Computer.groups.name description: Name of the group. - type: Date contextPath: CiscoAMP.Computer.last_seen description: Last date seen. - type: String contextPath: CiscoAMP.Computer.faults description: Faults. - type: Boolean contextPath: CiscoAMP.Computer.isolation.available description: Whether the isolation is available. - type: String contextPath: CiscoAMP.Computer.isolation.status description: Status of the isolation. - type: String contextPath: CiscoAMP.Computer.orbital.status description: Status of the orbital. - contextPath: Endpoint.Hostname description: The hostname of the endpoint. type: String - contextPath: Endpoint.ID description: The endpoint's identifier. type: String - contextPath: Endpoint.IPAddress description: The endpoint's IP address. type: String - contextPath: Endpoint.OS description: The endpoint's operating system. type: String - contextPath: Endpoint.OSVersion description: The endpoint's operating system's version. type: String - contextPath: Endpoint.Status description: The status of the endpoint (online/offline). type: String - contextPath: Endpoint.MACAddress description: The endpoint's MAC address. type: String - contextPath: Endpoint.Vendor description: The integration name of the endpoint vendor. type: String - arguments: - description: The connector GUID for a specific computer. name: connector_guid required: true - description: 'Freeform query string that currently accepts an: IP address, SHA-256, or URL.' name: query_string - description: Page number to return. name: page - description: Number of results in a page. Maximum is 5000. name: page_size - description: Number of total results to return. name: limit description: Provides a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP console. name: cisco-amp-computer-trajectory-list outputs: - type: String contextPath: CiscoAMP.ComputerTrajectory.connector_guid description: GUID of the connector. - type: String contextPath: CiscoAMP.ComputerTrajectory.id description: Event's ID. - type: Number contextPath: CiscoAMP.ComputerTrajectory.timestamp description: Event's timestamp. - type: Number contextPath: CiscoAMP.ComputerTrajectory.timestamp_nanoseconds description: Event's timestamp in nano seconds. - type: Date contextPath: CiscoAMP.ComputerTrajectory.date description: Event's date. - type: String contextPath: CiscoAMP.ComputerTrajectory.event_type description: Event's type. - type: Number contextPath: CiscoAMP.ComputerTrajectory.event_type_id description: Event's type ID. - type: String contextPath: CiscoAMP.ComputerTrajectory.group_guids description: Group GUID. - type: String contextPath: CiscoAMP.ComputerTrajectory.severity description: Event's severity. - type: String contextPath: CiscoAMP.ComputerTrajectory.detection description: Event's detection. - type: String contextPath: CiscoAMP.ComputerTrajectory.detection_id description: Event's detection ID. - type: String contextPath: CiscoAMP.ComputerTrajectory.file.disposition description: Disposition of the file. - type: String contextPath: CiscoAMP.ComputerTrajectory.file.file_name description: Name of the file. - type: String contextPath: CiscoAMP.ComputerTrajectory.file.file_path description: Path to the file. - type: String contextPath: CiscoAMP.ComputerTrajectory.file.file_type description: Type of the file. - type: String contextPath: CiscoAMP.ComputerTrajectory.file.identity.sha256 description: File's SHA-256. - type: String contextPath: CiscoAMP.ComputerTrajectory.file.identity.sha1 description: File's SHA-1. - type: String contextPath: CiscoAMP.ComputerTrajectory.file.identity.md5 description: File's MD5. - type: String contextPath: CiscoAMP.ComputerTrajectory.file.parent.disposition description: Disposition of parent. - type: String contextPath: CiscoAMP.ComputerTrajectory.file.parent.identity.sha256 description: SHA-256 of parent. - type: String contextPath: CiscoAMP.ComputerTrajectory.scan.description description: Description of the scan. - type: Boolean contextPath: CiscoAMP.ComputerTrajectory.scan.clean description: Whether the scan is clean. - type: Number contextPath: CiscoAMP.ComputerTrajectory.scan.scanned_files description: Number of scanned files. - type: Number contextPath: CiscoAMP.ComputerTrajectory.scan.scanned_processes description: Number of scanned processes. - type: Number contextPath: CiscoAMP.ComputerTrajectory.scan.scanned_paths description: Number of scanned paths. - type: Number contextPath: CiscoAMP.ComputerTrajectory.scan.malicious_detections description: Number of malicious detections. - arguments: - description: Username to filter by. name: username required: true - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit description: Fetch a list of computers that have observed activity by the given username. name: cisco-amp-computer-user-activity-list outputs: - contextPath: CiscoAMP.ComputerUserActivity.connector_guid description: GUID of the connector. type: String - contextPath: CiscoAMP.ComputerUserActivity.hostname description: Host's name. type: String - contextPath: CiscoAMP.ComputerUserActivity.active description: Whether the computer is active. type: Boolean - arguments: - description: The connector GUID for a specific computer. name: connector_guid required: true - description: Username to filter by. name: username - description: Page number to return. name: page - description: Number of results in a page. Maximum is 5000. name: page_size - description: Number of total results to return. name: limit description: Fetch a specific computer's trajectory with a given connector GUID and filter for events with user name activity. name: cisco-amp-computer-user-trajectory-list outputs: - type: String contextPath: CiscoAMP.ComputerUserTrajectory.connector_guid description: GUID of the connector. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.id description: Event's ID. - type: Number contextPath: CiscoAMP.ComputerUserTrajectory.timestamp description: Event's timestamp. - type: Number contextPath: CiscoAMP.ComputerUserTrajectory.timestamp_nanoseconds description: Event's timestamp in nano seconds. - type: Date contextPath: CiscoAMP.ComputerUserTrajectory.date description: Event's date. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.event_type description: Event's type. - type: Number contextPath: CiscoAMP.ComputerUserTrajectory.event_type_id description: Event's type ID. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.group_guids description: Group GUID. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.severity description: Event's severity. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.detection description: Event's detection. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.detection_id description: Event's detection ID. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.file.disposition description: Disposition of the file. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.file.file_name description: Name of the file. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.file.file_path description: Path to the file. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.file.file_type description: Type of the file. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.file.identity.sha256 description: File's SHA-256. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.file.identity.sha1 description: File's SHA-1. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.file.identity.md5 description: File's MD5. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.file.parent.disposition description: Disposition of parent. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.file.parent.identity.sha256 description: SHA-256 of parent. - type: String contextPath: CiscoAMP.ComputerUserTrajectory.scan.description description: Description of the scan. - type: Boolean contextPath: CiscoAMP.ComputerUserTrajectory.scan.clean description: Whether the scan is clean. - type: Number contextPath: CiscoAMP.ComputerUserTrajectory.scan.scanned_files description: Number of scanned files. - type: Number contextPath: CiscoAMP.ComputerUserTrajectory.scan.scanned_processes description: Number of scanned processes. - type: Number contextPath: CiscoAMP.ComputerUserTrajectory.scan.scanned_paths description: Number of scanned paths. - type: Number contextPath: CiscoAMP.ComputerUserTrajectory.scan.malicious_detections description: Number of malicious detections. - arguments: - description: The connector GUID for a specific computer. name: connector_guid required: true - description: The start date and time expressed according to ISO 8601. The retrieved list will include vulnerable programs detected at start_time. name: start_time - description: The end date and/or time expressed according to ISO 8601. Exclusive - if end_time is a time, the list will only include vulnerable programs detected before end_time). Inclusive - if end_time is a date, the list will include vulnerable programs detected on the date. name: end_time - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit description: Provides a list of vulnerabilities observed on a specific computer. The vulnerabilities can be filtered to show only vulnerable applications observed for a specific time range. name: cisco-amp-computer-vulnerabilities-list outputs: - type: String contextPath: CiscoAMP.ComputerVulnerability.connector_guid description: GUID of the connector. - type: String contextPath: CiscoAMP.ComputerVulnerability.application description: Name of the application. - type: String contextPath: CiscoAMP.ComputerVulnerability.version description: Version of the application. - type: String contextPath: CiscoAMP.ComputerVulnerability.file.filename description: Name of the file. - type: String contextPath: CiscoAMP.ComputerVulnerability.file.identity.sha256 description: File's SHA-256. - type: String contextPath: CiscoAMP.ComputerVulnerability.file.identity.sha1 description: File's SHA-1. - type: String contextPath: CiscoAMP.ComputerVulnerability.file.identity.md5 description: File's MD5. - type: String contextPath: CiscoAMP.ComputerVulnerability.cves.id description: Common vulnerability exposure ID. - type: String contextPath: CiscoAMP.ComputerVulnerability.cves.link description: Common vulnerability exposure link. - type: Number contextPath: CiscoAMP.ComputerVulnerability.cves.cvss description: Common vulnerability scoring system. - type: Number contextPath: CiscoAMP.ComputerVulnerability.latest_timestamp description: Vulnerability latest timestamp. - type: Date contextPath: CiscoAMP.ComputerVulnerability.latest_date description: Vulnerability latest date. - arguments: - description: The connector GUID for a specific computer. name: connector_guid required: true - description: Group GUID to move the computer to. name: group_guid required: true description: Moves a computer to a group with the given connector_guid and group_guid. name: cisco-amp-computer-move outputs: - type: String contextPath: CiscoAMP.Computer.connector_guid description: GUID of the connector. - type: String contextPath: CiscoAMP.Computer.hostname description: Host's name. - type: String contextPath: CiscoAMP.Computer.windows_processor_id description: Windows processor ID. - type: Boolean contextPath: CiscoAMP.Computer.active description: Whether the computer is active. - type: String contextPath: CiscoAMP.Computer.connector_version description: Version of the connector. - type: String contextPath: CiscoAMP.Computer.operating_system description: Operating system of the computer. - type: String contextPath: CiscoAMP.Computer.os_version description: Operating system version. - type: String contextPath: CiscoAMP.Computer.internal_ips description: List of internal IPs. - type: String contextPath: CiscoAMP.Computer.external_ip description: External IP. - type: String contextPath: CiscoAMP.Computer.group_guid description: GUID of the group. - type: Date contextPath: CiscoAMP.Computer.install_date description: Installation date. - type: Boolean contextPath: CiscoAMP.Computer.is_compromised description: Whether the computer is compromised. - type: Boolean contextPath: CiscoAMP.Computer.demo description: Whether the computer is a demo. - type: String contextPath: CiscoAMP.Computer.network_addresses.mac description: List of MAC addresses. - type: String contextPath: CiscoAMP.Computer.network_addresses.ip description: List of IP addresses. - type: String contextPath: CiscoAMP.Computer.policy.guid description: GUID of the policy. - type: String contextPath: CiscoAMP.Computer.policy.name description: Name of the policy. - type: String contextPath: CiscoAMP.Computer.groups.guid description: GUID of the group. - type: String contextPath: CiscoAMP.Computer.groups.name description: Name of the group. - type: Date contextPath: CiscoAMP.Computer.last_seen description: Last date seen. - type: String contextPath: CiscoAMP.Computer.faults description: Faults. - type: Boolean contextPath: CiscoAMP.Computer.isolation.available description: Whether the isolation is available. - type: String contextPath: CiscoAMP.Computer.isolation.status description: Status of the isolation. - type: String contextPath: CiscoAMP.Computer.orbital.status description: Status of the orbital. - arguments: - description: The connector GUID for a specific computer. name: connector_guid required: true description: Deletes a specific computer with given connector_guid. name: cisco-amp-computer-delete - arguments: - description: 'Freeform query string which currently accepts: IPv4 address (CIDR not supported), SHA-256, file name, and a URL fragment.' name: query_string required: true - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit description: Fetch a list of computers that have observed files with a given file name. Provides the ability to search all computers across an organization for any events or activities associated with a file or network operation, and returns computers matching those criteria. There is a hard limit of 5000 historical entries searched. name: cisco-amp-computer-activity-list outputs: - contextPath: CiscoAMP.ComputerActivity.connector_guid description: GUID of the connector. type: String - contextPath: CiscoAMP.ComputerActivity.hostname description: Host's name. type: String - contextPath: CiscoAMP.ComputerActivity.windows_processor_id description: Windows processor ID. type: String - contextPath: CiscoAMP.ComputerActivity.active description: Whether the computer is active. type: Boolean - arguments: - description: The connector GUID for a specific computer. name: connector_guid required: true description: Performs a feature availability request on a computer. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation. name: cisco-amp-computer-isolation-feature-availability-get - arguments: - description: The connector GUID for a specific computer. name: connector_guid required: true description: Returns a fine-grained isolation status for a computer. The available flag is set to true if isolation can be performed on the computer. Status will be set to one of - not_isolated, pending_start, isolated and pending_stop. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation. name: cisco-amp-computer-isolation-get outputs: - contextPath: CiscoAMP.ComputerIsolation.connector_guid description: ID of the connector. type: String - contextPath: CiscoAMP.ComputerIsolation.available description: Set to true if isolation can be performed on the computer. type: Boolean - contextPath: CiscoAMP.ComputerIsolation.status description: "Status of the computer isolation. Will be set to one of: not_isolated, pending_start, isolated and pending_stop." type: String - contextPath: CiscoAMP.ComputerIsolation.unlock_code description: Isolation unlock code. type: String - contextPath: CiscoAMP.ComputerIsolation.comment description: Isolation comment. type: String - contextPath: CiscoAMP.ComputerIsolation.ccms_message_guid description: Cisco Cluster Management Suite message GUID. type: String - contextPath: CiscoAMP.ComputerIsolation.ccms_job_guid description: Cisco Cluster Management Suite job GUID. type: String - arguments: - description: The interval in seconds between each poll. name: interval_in_seconds defaultValue: '30' - description: The timeout in seconds until polling ends. name: timeout_in_seconds defaultValue: '600' - description: The connector GUID for a specific computer. name: connector_guid required: true - description: Comment for isolation. name: comment required: true - description: Isolation unlock code. name: unlock_code required: true - description: Status of the current run. name: status description: Request isolation for a computer. Supports polling. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation. name: cisco-amp-computer-isolation-create polling: true outputs: - contextPath: CiscoAMP.ComputerIsolation.connector_guid description: ID of the connector. type: String - contextPath: CiscoAMP.ComputerIsolation.available description: Set to true if isolation can be performed on the computer. type: Boolean - contextPath: CiscoAMP.ComputerIsolation.status description: "Status of the computer isolation. Will be set to one of: not_isolated, pending_start, isolated and pending_stop." type: String - contextPath: CiscoAMP.ComputerIsolation.unlock_code description: Isolation unlock code. type: String - contextPath: CiscoAMP.ComputerIsolation.comment description: Isolation comment. type: String - contextPath: CiscoAMP.ComputerIsolation.isolated_by description: Isolation initiator. type: String - arguments: - description: The interval in seconds between each poll. name: interval_in_seconds defaultValue: '30' - description: The timeout in seconds until polling ends. name: timeout_in_seconds defaultValue: '600' - description: The connector GUID for a specific computer. name: connector_guid required: true - description: Comment for isolation deletion. name: comment - description: Status of the current run. name: status description: Request isolation stop for a computer. Supports polling. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation. name: cisco-amp-computer-isolation-delete polling: true outputs: - contextPath: CiscoAMP.ComputerIsolation.available description: Set to true if isolation can be performed on the computer. type: Boolean - contextPath: CiscoAMP.ComputerIsolation.status description: "Status of the computer isolation. Will be set to one of: not_isolated, pending_start, isolated and pending_stop." type: String - contextPath: CiscoAMP.ComputerIsolation.unlock_code description: Isolation unlock code. type: String - contextPath: CiscoAMP.ComputerIsolation.comment description: Isolation comment. type: String - contextPath: CiscoAMP.ComputerIsolation.isolated_by description: Isolation initiator. type: String - arguments: - description: Detection SHA-256 to filter by. name: detection_sha256 - description: Application SHA-256 to filter by. name: application_sha256 - description: Comma-separated list for connector GUIDs to filter by. isArray: true name: connector_guid - description: Comma-separated list for group GUIDs to filter by. isArray: true name: group_guid - description: Fetch events that are newer than the given time. name: start_date - description: Comma-separated list for event types to filter by. isArray: true name: event_type - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit description: Fetch a list of events that can be filtered by a variety of criteria. Each criteria type is logically ANDed with the other criteria, and each selection of a criteria is logically ORed. This is analogous to the Events view on the FireAMP Console. name: cisco-amp-event-list outputs: - type: Number contextPath: CiscoAMP.Event.id description: Event's ID. - type: Number contextPath: CiscoAMP.Event.timestamp description: Event's timestamp. - type: Number contextPath: CiscoAMP.Event.timestamp_nanoseconds description: Event's timestamp in nano seconds. - type: Date contextPath: CiscoAMP.Event.date description: Event's date. - type: String contextPath: CiscoAMP.Event.event_type description: Event's type. - type: Number contextPath: CiscoAMP.Event.event_type_id description: Event's type ID. - type: String contextPath: CiscoAMP.Event.detection description: Event's detection. - type: String contextPath: CiscoAMP.Event.detection_id description: Event's detection ID. - type: String contextPath: CiscoAMP.Event.connector_guid description: GUID of the connector. - type: String contextPath: CiscoAMP.Event.group_guids description: Event's group GUID. - type: String contextPath: CiscoAMP.Event.severity description: Event's severity. - type: String contextPath: CiscoAMP.Event.computer.connector_guid description: GUID of the connector. - type: String contextPath: CiscoAMP.Event.computer.hostname description: Host's name. - type: String contextPath: CiscoAMP.Event.computer.external_ip description: External IP. - type: Boolean contextPath: CiscoAMP.Event.computer.active description: Whether the computer is active. - type: String contextPath: CiscoAMP.Event.computer.user description: Computer user. - type: String contextPath: CiscoAMP.Event.computer.network_addresses.ip description: List of IP addresses. - type: String contextPath: CiscoAMP.Event.computer.network_addresses.mac description: List of MAC addresses. - type: String contextPath: CiscoAMP.Event.file.disposition description: Disposition of the file. - type: String contextPath: CiscoAMP.Event.file.file_name description: Name of the file. - type: String contextPath: CiscoAMP.Event.file.file_path description: Path to the file. - type: String contextPath: CiscoAMP.Event.file.identity.sha256 description: File's SHA-256. - type: String contextPath: CiscoAMP.Event.file.identity.sha1 description: File's SHA-1. - type: String contextPath: CiscoAMP.Event.file.identity.md5 description: File's MD5. - type: Number contextPath: CiscoAMP.Event.file.parent.process_id description: Parent's process ID. - type: String contextPath: CiscoAMP.Event.file.parent.file_name description: Parent's file name. - type: String contextPath: CiscoAMP.Event.file.parent.disposition description: Parent's disposition. - type: String contextPath: CiscoAMP.Event.file.parent.identity.sha256 description: Parent's SHA-256. - type: String contextPath: CiscoAMP.Event.file.parent.identity.sha1 description: Parent's SHA-1. - type: String contextPath: CiscoAMP.Event.file.parent.identity.md5 description: Parent's MD5. - type: String contextPath: CiscoAMP.Event.scan.description description: Description of the scan. - type: Boolean contextPath: CiscoAMP.Event.scan.clean description: Whether the scan is clean. - type: Number contextPath: CiscoAMP.Event.scan.scanned_files description: Number of scanned files. - type: Number contextPath: CiscoAMP.Event.scan.scanned_processes description: Number of scanned processes. - type: Number contextPath: CiscoAMP.Event.scan.scanned_paths description: Number of scanned paths. - type: Number contextPath: CiscoAMP.Event.scan.malicious_detections description: Number of malicious detections. - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.Path description: The path where the file is located. type: String - contextPath: File.Hostname description: The name of the host where the file was found. type: String - contextPath: File.Malicious.Vendor description: The vendor that reported the file as malicious. type: String - contextPath: File.Malicious.Description description: A description explaining why the file was determined to be malicious. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - arguments: - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit description: Fetches a list of event types. Events are identified and filtered by a unique ID. name: cisco-amp-event-type-list outputs: - contextPath: CiscoAMP.EventType.id description: Event type ID. type: Number - contextPath: CiscoAMP.EventType.name description: Event type name. type: String - contextPath: CiscoAMP.EventType.description description: Event type description. type: String - arguments: - description: Fetch a list type to return. name: file_list_type defaultValue: Application Blocking auto: PREDEFINED predefined: - Application Blocking - Simple Custom Detection - description: Comma-separated list of name to filter by (has auto complete capabilities). isArray: true name: name - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit - description: GUID of the file list to return. name: file_list_guid description: Returns a particular file list for application blocking or simple custom detection. file_list_guid must be provided to retrieve information about a particular file_list. Can fetch an application_blocking or simple_custom_detection file list. Defaults to application_blocking. name: cisco-amp-file-list-list outputs: - contextPath: CiscoAMP.FileList.name description: Name of blocking. type: String - contextPath: CiscoAMP.FileList.guid description: File list GUID. type: String - contextPath: CiscoAMP.FileList.type description: Type of blocking. type: String - arguments: - description: File list to return. name: file_list_guid required: true - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit - description: File list item SHA-256 to search. name: sha256 description: Returns a list of items for a particular file_list. file_list_guid must be provided to retrieve these items. A particular item can be returned by providing a SHA-256. name: cisco-amp-file-list-item-list outputs: - contextPath: CiscoAMP.FileListItem.name description: Name of file list. type: String - contextPath: CiscoAMP.FileListItem.guid description: File list GUID. type: String - contextPath: CiscoAMP.FileListItem.policies.name description: Name of the policy. type: String - contextPath: CiscoAMP.FileListItem.policies.guid description: Policy GUID. type: String - contextPath: CiscoAMP.FileListItem.items.sha256 description: Item SHA-256. type: String - contextPath: CiscoAMP.FileListItem.items.source description: Item source. type: String - arguments: - description: File list to add to. name: file_list_guid required: true - description: File list item's SHA-256 to add. name: sha256 required: true - description: Description for the created item. name: description description: Creates a file list item with a given SHA-256 for a specific file list with a given file_list_guid. name: cisco-amp-file-list-item-create outputs: - contextPath: CiscoAMP.FileListItem.sha256 description: Item SHA-256. type: String - contextPath: CiscoAMP.FileListItem.description description: File's description. type: String - contextPath: CiscoAMP.FileListItem.source description: Item source. type: String - arguments: - description: File list to delete from. name: file_list_guid required: true - description: File list item SHA-256 to delete. name: sha256 required: true description: Deletes a file list item with a given SHA-256 and associated to a file list with a given file_list_guid. name: cisco-amp-file-list-item-delete - arguments: - description: Name to filter by (has auto complete capabilities). name: name - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit - description: Group's GUID. name: group_guid description: Provides information about groups in an organization. name: cisco-amp-group-list outputs: - type: String contextPath: CiscoAMP.Group.name description: Name of the group. - type: String contextPath: CiscoAMP.Group.description description: Group's description. - type: String contextPath: CiscoAMP.Group.guid description: Group GUID. - type: String contextPath: CiscoAMP.Group.source description: Creation source. - type: String contextPath: CiscoAMP.Group.creator description: Creator of the group. - type: Date contextPath: CiscoAMP.Group.created_at description: Date of creation. - type: Number contextPath: CiscoAMP.Group.computers_count description: Number of computers in the group. - type: Number contextPath: CiscoAMP.Group.descendant_computers_count description: Number of computers from descendant groups. - type: String contextPath: CiscoAMP.Group.ancestry.name description: Parent group name. - type: String contextPath: CiscoAMP.Group.ancestry.guid description: Parent group GUID. - type: String contextPath: CiscoAMP.Group.child_groups.name description: Child group name. - type: String contextPath: CiscoAMP.Group.child_groups.guid description: Child group GUID. - type: String contextPath: CiscoAMP.Group.policies.name description: Policy name. - type: String contextPath: CiscoAMP.Group.policies.description description: Policy description. - type: String contextPath: CiscoAMP.Group.policies.guid description: Policy GUID. - type: String contextPath: CiscoAMP.Group.policies.product description: Policy operating system product. - type: Boolean contextPath: CiscoAMP.Group.policies.default description: Whether the policy is the default policy. - type: Number contextPath: CiscoAMP.Group.policies.serial_number description: Policy serial number. - type: Boolean contextPath: CiscoAMP.Group.policies.inherited description: Whether the policy is inherited. - type: String contextPath: CiscoAMP.Group.policies.file_lists.name description: File list name. - type: String contextPath: CiscoAMP.Group.policies.file_lists.guid description: File list GUID. - type: String contextPath: CiscoAMP.Group.policies.file_lists.type description: File list type. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.name description: IP list name. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.guid description: IP list GUID. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.type description: IP list type. - type: String contextPath: CiscoAMP.Group.policies.exclusion_sets.name description: Exclusion set name. - type: String contextPath: CiscoAMP.Group.policies.exclusion_sets.guid description: Exclusion set GUID. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.name description: Name of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.description description: Description of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.guid description: GUID of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.source description: Creation source of the group the policy is used in. - arguments: - description: Group's GUID. name: group_guid required: true - description: Policy GUID for Windows. name: windows_policy_guid - description: Policy GUID for MAC. name: mac_policy_guid - description: Policy GUID for Android. name: android_policy_guid - description: Policy GUID for Linux. name: linux_policy_guid description: Updates a group to a given policy and returns all the policies in that group. name: cisco-amp-group-policy-update outputs: - type: String contextPath: CiscoAMP.Group.name description: Name of the group. - type: String contextPath: CiscoAMP.Group.description description: Group's description. - type: String contextPath: CiscoAMP.Group.guid description: Group GUID. - type: String contextPath: CiscoAMP.Group.source description: Creation source. - type: String contextPath: CiscoAMP.Group.creator description: Creator of the group. - type: Date contextPath: CiscoAMP.Group.created_at description: Date of creation. - type: Number contextPath: CiscoAMP.Group.computers_count description: Number of computers in the group. - type: Number contextPath: CiscoAMP.Group.descendant_computers_count description: Number of computers from descendant groups. - type: String contextPath: CiscoAMP.Group.ancestry.name description: Parent group name. - type: String contextPath: CiscoAMP.Group.ancestry.guid description: Parent group GUID. - type: String contextPath: CiscoAMP.Group.child_groups.name description: Child group name. - type: String contextPath: CiscoAMP.Group.child_groups.guid description: Child group GUID. - type: String contextPath: CiscoAMP.Group.policies.name description: Policy name. - type: String contextPath: CiscoAMP.Group.policies.description description: Policy description. - type: String contextPath: CiscoAMP.Group.policies.guid description: Policy GUID. - type: String contextPath: CiscoAMP.Group.policies.product description: Policy operating system product. - type: Boolean contextPath: CiscoAMP.Group.policies.default description: Whether the policy is the default policy. - type: Number contextPath: CiscoAMP.Group.policies.serial_number description: Policy serial number. - type: Boolean contextPath: CiscoAMP.Group.policies.inherited description: Whether the policy is inherited. - type: String contextPath: CiscoAMP.Group.policies.file_lists.name description: File list name. - type: String contextPath: CiscoAMP.Group.policies.file_lists.guid description: File list GUID. - type: String contextPath: CiscoAMP.Group.policies.file_lists.type description: File list type. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.name description: IP list name. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.guid description: IP list GUID. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.type description: IP list type. - type: String contextPath: CiscoAMP.Group.policies.exclusion_sets.name description: Exclusion set name. - type: String contextPath: CiscoAMP.Group.policies.exclusion_sets.guid description: Exclusion set GUID. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.name description: Name of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.description description: Description of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.guid description: GUID of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.source description: Creation source of the group the policy is used in. - arguments: - description: Group's GUID. name: child_guid required: true - description: Group parent to set to child group. name: parent_group_guid description: Converts an existing group to a child of another group or an existing child group to a root group (that is, one with no parent groups). name: cisco-amp-group-parent-update outputs: - type: String contextPath: CiscoAMP.Group.name description: Name of the group. - type: String contextPath: CiscoAMP.Group.description description: Group's description. - type: String contextPath: CiscoAMP.Group.guid description: Group GUID. - type: String contextPath: CiscoAMP.Group.source description: Creation source. - type: String contextPath: CiscoAMP.Group.creator description: Creator of the group. - type: Date contextPath: CiscoAMP.Group.created_at description: Date of creation. - type: Number contextPath: CiscoAMP.Group.computers_count description: Number of computers in the group. - type: Number contextPath: CiscoAMP.Group.descendant_computers_count description: Number of computers from descendant groups. - type: String contextPath: CiscoAMP.Group.ancestry.name description: Parent group name. - type: String contextPath: CiscoAMP.Group.ancestry.guid description: Parent group GUID. - type: String contextPath: CiscoAMP.Group.child_groups.name description: Child group name. - type: String contextPath: CiscoAMP.Group.child_groups.guid description: Child group GUID. - type: String contextPath: CiscoAMP.Group.policies.name description: Policy name. - type: String contextPath: CiscoAMP.Group.policies.description description: Policy description. - type: String contextPath: CiscoAMP.Group.policies.guid description: Policy GUID. - type: String contextPath: CiscoAMP.Group.policies.product description: Policy operating system product. - type: Boolean contextPath: CiscoAMP.Group.policies.default description: Whether the policy is the default policy. - type: Number contextPath: CiscoAMP.Group.policies.serial_number description: Policy serial number. - type: Boolean contextPath: CiscoAMP.Group.policies.inherited description: Whether the policy is inherited. - type: String contextPath: CiscoAMP.Group.policies.file_lists.name description: File list name. - type: String contextPath: CiscoAMP.Group.policies.file_lists.guid description: File list GUID. - type: String contextPath: CiscoAMP.Group.policies.file_lists.type description: File list type. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.name description: IP list name. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.guid description: IP list GUID. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.type description: IP list type. - type: String contextPath: CiscoAMP.Group.policies.exclusion_sets.name description: Exclusion set name. - type: String contextPath: CiscoAMP.Group.policies.exclusion_sets.guid description: Exclusion set GUID. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.name description: Name of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.description description: Description of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.guid description: GUID of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.source description: Creation source of the group the policy is used in. - arguments: - description: Group name. name: name required: true - description: Group description. name: description required: true description: Creates a new group along with a group name or description. name: cisco-amp-group-create outputs: - type: String contextPath: CiscoAMP.Group.name description: Name of the group. - type: String contextPath: CiscoAMP.Group.description description: Group's description. - type: String contextPath: CiscoAMP.Group.guid description: Group GUID. - type: String contextPath: CiscoAMP.Group.source description: Creation source. - type: String contextPath: CiscoAMP.Group.creator description: Creator of the group. - type: Date contextPath: CiscoAMP.Group.created_at description: Date of creation. - type: Number contextPath: CiscoAMP.Group.computers_count description: Number of computers in the group. - type: Number contextPath: CiscoAMP.Group.descendant_computers_count description: Number of computers from descendant groups. - type: String contextPath: CiscoAMP.Group.policies.name description: Policy name. - type: String contextPath: CiscoAMP.Group.policies.description description: Policy description. - type: String contextPath: CiscoAMP.Group.policies.guid description: Policy GUID. - type: String contextPath: CiscoAMP.Group.policies.product description: Policy operating system product. - type: Boolean contextPath: CiscoAMP.Group.policies.default description: Whether the policy is the default policy. - type: Number contextPath: CiscoAMP.Group.policies.serial_number description: Policy serial number. - type: Boolean contextPath: CiscoAMP.Group.policies.inherited description: Whether the policy is inherited. - type: String contextPath: CiscoAMP.Group.policies.file_lists.name description: File list name. - type: String contextPath: CiscoAMP.Group.policies.file_lists.guid description: File list GUID. - type: String contextPath: CiscoAMP.Group.policies.file_lists.type description: File list type. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.name description: IP list name. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.guid description: IP list GUID. - type: String contextPath: CiscoAMP.Group.policies.ip_lists.type description: IP list type. - type: String contextPath: CiscoAMP.Group.policies.exclusion_sets.name description: Exclusion set name. - type: String contextPath: CiscoAMP.Group.policies.exclusion_sets.guid description: Exclusion set GUID. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.name description: Name of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.description description: Description of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.guid description: GUID of the group the policy is used in. - type: String contextPath: CiscoAMP.Group.policies.used_in_groups.source description: Creation source of the group the policy is used in. - arguments: - description: Group's GUID. name: group_guid required: true description: Destroys a group with a given GUID. name: cisco-amp-group-delete - arguments: - description: Indicator GUID. name: indicator_guid - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit description: Show information about indicators. name: cisco-amp-indicator-list outputs: - type: String contextPath: CiscoAMP.Indicator.name description: Indicator name. - type: String contextPath: CiscoAMP.Indicator.description description: Indicator description. - type: String contextPath: CiscoAMP.Indicator.guid description: Indicator GUID. - type: String contextPath: CiscoAMP.Indicator.severity description: Indicator severity. - type: String contextPath: CiscoAMP.Indicator.mitre.tactics.external_id description: Mitre tactic ID. - type: String contextPath: CiscoAMP.Indicator.mitre.tactics.name description: Mitre tactic name. - type: String contextPath: CiscoAMP.Indicator.mitre.tactics.mitre_url description: Mitre tactic URL. - type: String contextPath: CiscoAMP.Indicator.mitre.techniques.external_id description: Mitre technique ID. - type: String contextPath: CiscoAMP.Indicator.mitre.techniques.name description: Mitre technique name. - type: String contextPath: CiscoAMP.Indicator.mitre.techniques.mitre_url description: Mitre technique URL. - type: Number contextPath: CiscoAMP.Indicator.observed_compromises description: Total number of observed compromises. - type: Number contextPath: CiscoAMP.Indicator.observed_compromises.unresolved description: Number of unresolved compromises. - type: Number contextPath: CiscoAMP.Indicator.observed_compromises.in_progress description: Number of compromises in progress. - type: Number contextPath: CiscoAMP.Indicator.observed_compromises.resolved description: Number of resolved compromises. - arguments: - description: Policy GUID. name: policy_guid - description: Comma-separated list for products to filter by. isArray: true name: product - description: Comma-separated list for names to filter by (has auto complete capabilities). isArray: true name: name - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit description: Gets information about policies by filtering with a product and name of a specific policy with a policy_guid. name: cisco-amp-policy-list outputs: - type: String contextPath: CiscoAMP.Policy.name description: Policy name. - type: String contextPath: CiscoAMP.Policy.description description: Policy description. - type: String contextPath: CiscoAMP.Policy.guid description: Policy GUID. - type: String contextPath: CiscoAMP.Policy.product description: Product used. - type: Boolean contextPath: CiscoAMP.Policy.default description: Whether the policy is the default policy. - type: Number contextPath: CiscoAMP.Policy.serial_number description: Policy serial number. - type: String contextPath: CiscoAMP.Policy.file_lists.name description: File list name. - type: String contextPath: CiscoAMP.Policy.file_lists.guid description: File list GUID. - type: String contextPath: CiscoAMP.Policy.file_lists.type description: File list type. - type: String contextPath: CiscoAMP.Policy.ip_lists.name description: IP list name. - type: String contextPath: CiscoAMP.Policy.ip_lists.guid description: IP list GUID. - type: String contextPath: CiscoAMP.Policy.ip_lists.type description: IP list type. - type: String contextPath: CiscoAMP.Policy.exclusion_sets.name description: Exclusion set name. - type: String contextPath: CiscoAMP.Policy.exclusion_sets.guid description: Exclusion set GUID. - type: String contextPath: CiscoAMP.Policy.used_in_groups.name description: Group name. - type: String contextPath: CiscoAMP.Policy.used_in_groups.description description: Group description. - type: String contextPath: CiscoAMP.Policy.used_in_groups.guid description: Group GUID. - arguments: - description: IOS bundle ID for app trajectory. name: ios_bid required: true - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit description: Retrieve app_trajectory queries for a given IOS bundle ID. name: cisco-amp-app-trajectory-query-list outputs: - type: String contextPath: CiscoAMP.AppTrajectoryQuery.connector_guid description: GUID of the connector. - type: String contextPath: CiscoAMP.AppTrajectoryQuery.bundle_id description: Bundle ID. - type: String contextPath: CiscoAMP.AppTrajectoryQuery.group_guids description: List of group's GUIDs. - type: String contextPath: CiscoAMP.AppTrajectoryQuery.cdhash description: CD hHash. - type: Number contextPath: CiscoAMP.AppTrajectoryQuery.timestamp description: Observed timestamp. - type: Number contextPath: CiscoAMP.AppTrajectoryQuery.timestamp_nanoseconds description: Observed timestamp in nano seconds. - type: Date contextPath: CiscoAMP.AppTrajectoryQuery.date description: Observed date. - type: String contextPath: CiscoAMP.AppTrajectoryQuery.query_type description: The type of the query. - type: String contextPath: CiscoAMP.AppTrajectoryQuery.network_info.dirty_url description: Link to the observed URL. - type: String contextPath: CiscoAMP.AppTrajectoryQuery.network_info.remote_ip description: Remote IP. - type: Number contextPath: CiscoAMP.AppTrajectoryQuery.network_info.remote_port description: Remote port. - type: String contextPath: CiscoAMP.AppTrajectoryQuery.network_info.local_ip description: Local IP. - type: Number contextPath: CiscoAMP.AppTrajectoryQuery.network_info.local_port description: Local Port. - type: String contextPath: CiscoAMP.AppTrajectoryQuery.network_info.direction description: Outgoing or incoming connection. - type: String contextPath: CiscoAMP.AppTrajectoryQuery.network_info.protocol description: Communication protocol used. - type: String contextPath: CiscoAMP.AppTrajectoryQuery.ver description: Version. - description: Get API version. name: cisco-amp-version-get outputs: - type: String contextPath: CiscoAMP.Version.version description: API version. - arguments: - description: SHA-256 that has been observed as a vulnerability. name: sha256 - description: Comma-separated list for group GUIDs to filter by. isArray: true name: group_guid - description: The start date and time expressed according to ISO 8601. The retrieved list will include vulnerable programs detected at start_time. name: start_time - description: The end date and/or time expressed according to ISO 8601. Exclusive - if end_time is a time, the list will only include vulnerable programs detected before end_time). Inclusive - if end_time is a date, the list will include vulnerable programs detected on the date. name: end_time - description: Page number to return. name: page - description: Number of results in a page. Maximum is 500. name: page_size - description: Number of total results to return. name: limit description: 'Fetch a list of vulnerabilities. This is analogous to the Vulnerable Software view on the AMP for Endpoints Console. The list can be filtered to show only the vulnerable programs detected for a specific time range. Provide a list of computers on which the vulnerability has been observed with given SHA-256. The list item contains a summary of information on the vulnerability, including: application name and version, SHA-256 value for the executable file, connectors on which the vulnerable application was observed and the most recent CVSS score. IMPORTANT: computers key returns information about the last 1000 Connectors on which the vulnerable application was observed.' name: cisco-amp-vulnerability-list outputs: - type: String contextPath: CiscoAMP.Vulnerability.application description: Name of the application. - type: String contextPath: CiscoAMP.Vulnerability.version description: Version of the application. - type: String contextPath: CiscoAMP.Vulnerability.file.filename description: Name of the file. - type: String contextPath: CiscoAMP.Vulnerability.file.identity.sha256 description: File's SHA-256. - type: Number contextPath: CiscoAMP.Vulnerability.latest_timestamp description: Vulnerability latest timestamp. - type: Date contextPath: CiscoAMP.Vulnerability.latest_date description: Vulnerability latest date. - type: Number contextPath: CiscoAMP.Vulnerability.computers_total_count description: Number of computers. - type: String contextPath: CiscoAMP.Vulnerability.connector_guid description: GUID of the connector. - type: String contextPath: CiscoAMP.Vulnerability.hostname description: Host's name. - type: String contextPath: CiscoAMP.Vulnerability.windows_processor_id description: Windows processor ID. - type: Boolean contextPath: CiscoAMP.Vulnerability.active description: Whether the computer is active. - type: String contextPath: CiscoAMP.Vulnerability.group_guid description: Group's GUID. - type: String contextPath: CiscoAMP.Vulnerability.cves.id description: Common vulnerability exposure ID. - type: String contextPath: CiscoAMP.Vulnerability.cves.link description: Common vulnerability exposure link. - type: Number contextPath: CiscoAMP.Vulnerability.cves.cvss description: Common vulnerability scoring system. - type: String contextPath: CiscoAMP.Vulnerability.groups.name description: Group's name. - type: String contextPath: CiscoAMP.Vulnerability.groups.description description: Group's description. - type: String contextPath: CiscoAMP.Vulnerability.groups.guid description: Group's GUID. - type: String contextPath: CiscoAMP.Vulnerability.groups.source description: Group's source of creation. - type: String contextPath: CiscoAMP.Vulnerability.computers.connector_guid description: GUID of the connector. - type: String contextPath: CiscoAMP.Vulnerability.computers.hostname description: Host's name. - type: String contextPath: CiscoAMP.Vulnerability.computers.windows_processor_id description: Windows processor ID. - type: Boolean contextPath: CiscoAMP.Vulnerability.computers.active description: Whether the computer is active. - arguments: - description: The endpoint ID. Takes priority over the IP and hostname arguments. isArray: true name: id - default: true description: The endpoint IP address. The IP argument has priority over the hostname argument. isArray: true name: ip - description: The endpoint hostname. isArray: true name: hostname description: Returns information about an endpoint. name: endpoint outputs: - contextPath: Endpoint.Hostname description: The hostname of the endpoint. type: String - contextPath: Endpoint.ID description: The endpoint's identifier. type: String - contextPath: Endpoint.IPAddress description: The endpoint's IP address. type: String - contextPath: Endpoint.OS description: The endpoint's operating system. type: String - contextPath: Endpoint.OSVersion description: The endpoint's operating system's version. type: String - contextPath: Endpoint.Status description: The status of the endpoint (online/offline). type: String - contextPath: Endpoint.MACAddress description: The endpoint's MAC address. type: String - contextPath: Endpoint.Vendor description: The integration name of the endpoint vendor. type: String - name: file description: Runs reputation on files. arguments: - name: file required: true default: true description: Hash of the file to query. Supports only SHA256. isArray: true outputs: - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.Path description: The path where the file is located. type: String - contextPath: File.Hostname description: The name of the host where the file was found. type: String - contextPath: File.Malicious.Vendor description: The vendor that reported the file as malicious. type: String - contextPath: File.Malicious.Description description: A description of why the file was determined to be malicious. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - description: Get license information about the tenant such as number of connectors registered, tier level, licensed seats count etc. name: cisco-amp-license-get outputs: - contextPath: CiscoAMP.LicenseInformation.number_of_connectors_registered description: The number of currently registered connectors. type: Number - contextPath: CiscoAMP.LicenseInformation.number_of_connectors_seen_in_the_last_30_days description: The number of recently seen connectors in the last 30 days. type: Number - contextPath: CiscoAMP.LicenseInformation.license_summaries.end_date description: The end date of the license. type: String - contextPath: CiscoAMP.LicenseInformation.license_summaries.start_date description: The start date of the license. type: String - contextPath: CiscoAMP.LicenseInformation.license_summaries.licensed_seats_count description: The number of licensed seats. type: Number - contextPath: CiscoAMP.LicenseInformation.license_summaries.tier description: The tier type of the license. type: String dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false script: '-' subtype: python3 type: python fromversion: 6.5.0 tests: - No tests (auto formatted)