Cisco Advanced Malware Protection (AMP)

Cisco Advanced Malware Protection (AMP) includes threat intelligence, sandboxing, and malware blocking to detect, contain, and remove malware.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices, Aggregated Security Findings, SaaS Applications

Before You Begin

APIs

Axonius uses the Cisco Secure Endpoint API to retrieve asset data. The following endpoints are called:

• GET /v1/computers - Fetch devices
• GET /v1/vulnerabilities - Fetch vulnerabilities (only when Fetch vulnerabilities is enabled)
• GET /v1/groups - Fetch device groups (only when Fetch Device Groups is enabled)

When Fetch listening ports via Orbital is enabled, Axonius also uses the Cisco Orbital API with the host of the selected Orbital Region, or the value supplied in Orbital API URL:

• POST /iroh/oauth2/token - Obtain an Orbital access token
• POST /v0/query - Submit the Orbital query for listening ports and their owning processes
• GET /v0/jobs/{job_id}/results - Retrieve the Orbital query results

The following endpoints are used by the related enforcement actions:

• GET /v1/computers/{connector_guid} - Get device details
• PATCH /v1/computers/{connector_guid} - Assign a device to a group
• PUT /v1/computers/{connector_guid}/isolation - Isolate a device
• DELETE /v1/computers/{connector_guid}/isolation - Unisolate a device

Required Permissions

The value supplied in Client ID and API Key must have read access to devices.

To create an API key from the admin panel:

1. Log into to the admin panel of Cisco AMP.
2. Go to the Business Page from the Accounts dropdown menu.
3. Click on the 'Edit' button.
4. Under features, click on "Regenerate…" button beside "3rd Party API Access" to generate the client ID and secure API Key.
5. Use these to connect to Cisco AMP with Axonius

To fetch listening ports via Orbital, the values supplied in Orbital Client ID and Orbital Client Secret must belong to a Cisco XDR or Secure Client API client with the Orbital scope. Cisco Secure Endpoint Advantage or Premier, and a device policy with Orbital enabled, are also required.

Connecting the Adapter in Axonius

1. Navigate to the Adapter Catalog, search for Cisco Advanced Malware Protection (AMP), and select the adapter.
2. Click Add Connection.
3. Provide the following parameters.

Required Parameters

1. Domain (required, default: https://api.amp.cisco.com) - URL of the Cisco AMP domain.
2. Client ID and API Key (required) - The credentials for a user account that has the Required Permissions to fetch assets.

Optional Parameters

1. HTTPS Proxy (optional, default: empty) - A proxy to use when connecting to the value supplied in Domain.
   • When supplied, Axonius uses the proxy when connecting to the value supplied in Domain.
   • When not supplied, Axonius connects directly to the value supplied in Domain.
2. Orbital Client ID (optional) - The client ID of a Cisco XDR or Secure Client API client with the Orbital scope. Required when Fetch listening ports via Orbital is enabled in the Advanced Settings.
3. Orbital Client Secret (optional) - The client secret of the Cisco Orbital API client. Required when Fetch listening ports via Orbital is enabled in the Advanced Settings.
4. Orbital Region (optional, default: North America) - Select the Cisco Orbital region to use when Orbital API URL is empty. The options are North America, Europe, and Asia Pacific, Japan, and China.
5. Orbital API URL (optional, default: empty) - A Cisco Orbital API URL that overrides the regional hosts. When supplied, Axonius sends both the token and the query requests to this URL.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Parallel Requests Count (required, default: 5) - Set the maximum number of threads that execute API calls in parallel when fetching vulnerabilities.
2. Fetch vulnerabilities (required, default: False) - Select whether to fetch vulnerabilities on devices.
   • When enabled, all connections for this adapter also fetch vulnerabilities.
   • When disabled, all connections for this adapter do not fetch vulnerabilities.
3. Fetch Device Groups (required, default: False) - Set to send an extra request to get all groups in order to parse the group name for each device.
4. Fetch listening ports via Orbital (required, default: False) - Select to run a Cisco Orbital query for devices that have Orbital enabled, and add their listening ports and owning processes to the device. Requires the Orbital parameters in the Optional Parameters, Cisco Secure Endpoint Advantage or Premier, and a device policy with Orbital enabled.
5. Orbital query wait (minutes) (required, default: 10) - Set how long the fetch waits for devices to answer the Orbital query. Enter an integer of 1 or greater. Devices that do not answer within this time are fetched without listening-port data.

Related Enforcement Actions:

• Cisco AMP - Isolate Assets
• Cisco AMP - Unisolate Assets
• Cisco AMP - Assign Assets to Group
• Enrich Cisco AMP device using Cisco Orbital