Cisco Secure Endpoint integration

Overview

Cisco Secure Endpoint (formerly AMP for Endpoints) is Cisco's endpoint protection and detection platform that enables organizations to manage, monitor, and defend endpoint security.

This connector supports two modes of data ingestion:

• Audit Logs: Activity logs from the Secure Endpoint console (e.g. configuration changes, user actions)
• Event Streams: Real-time security events such as detections, policy updates, and threat activity via the Event Streams API

For audit logs, it uses the Audit Logs API (GET /v1/auditlogs)
For real-time events, it uses the Event Streams API (POST /v1/event_streams) to establish an AMQP stream.

Prerequisites

• Client ID: API credential Client ID generated in the console
• Client Secret: API credential secret (API Key) generated in the console
• API Base URL: API endpoint (e.g. https://api.amp.cisco.com)
• Cisco Secure Endpoint administrator access
• Bloo platform access credentials

Configuration Steps

1. Generate API Credentials

1. Log in to your Cisco Secure Endpoint (AMP) console as an administrator
2. Navigate to Accounts → Organization Settings (or Accounts → API Credentials)
3. Click Configure API Credentials under the Features section
4. Click New API Credential (or + New API Credential)
5. Provide an Application Name and select the Scope (e.g. Read-only or Read & Write)
6. Click Create
7. The page will display the Client ID and API Key; copy and save them immediately, as the API Key cannot be retrieved later
8. Use those credentials with HTTP Basic Auth (i.e. Authorization: Basic base64(<client_id>:<api_key>)) for v0/v1 API access

2. Configure Connector Settings

Field	Description
Connector Name	Name of this connector instance
Connector Type	Fixed: "Cisco Secure Endpoint Connector"
Client ID	API credential Client ID generated in the console
Client Secret	API credential secret (API Key) generated in the console
API Base URL	API endpoint (e.g. https://api.amp.cisco.com)
Log Type	audit_logs or event_streams (mode of ingestion)
Log Level	Verbosity level for internal logging
Number of Threads	Number of parallel threads for fetching logs

3. Test Connection

After populating the fields, click Next:

• On success, you should see a "SUCCESS" message with timestamp
• If validation fails, an error message will be displayed

API Documentation

For further reference, consult Cisco's official API documentation:

• Audit Logs / API overview: Secure Endpoint Overview – Generating API Credentials
• Integration Workflows: AMP Integration Workflows, Creating an API Client

Troubleshooting

For additional help, refer to:

• Cisco's Secure Endpoint API documentation
• DNIF's connector troubleshooting page
• Bloo platform support documentation

Security Considerations

• Store API credentials securely
• Use appropriate scope permissions (Read-only vs Read & Write)
• Monitor API usage and rate limits
• Regularly rotate API credentials for enhanced security