Cisco AMP for Endpoints
Version: 1.2
Updated: Jun 21, 2023
Perform a wide variety of Enrichment and Containment actions for endpoint investigation and response with Cisco AMP for Endpoints.
Actions​
- Get Computer (Enrichment) - Get information about a specific endpoint.
- Get Computers (Enrichment) - Get a list of computers matching a query.
- Get Computer Activity (Enrichment) - Get the activity from a computer.
- Get Computer Trajectory (Enrichment) - Get the trajectory from a computer with an optional query.
- Get Computer User Activity (Enrichment) - Get the user activity from a computer.
- Get Computer User Trajectory (Enrichment) - Get the user trajectory from a computer with an optional query.
- Get File List (Enrichment) - Get the results of a file list.
- Get File List Files (Enrichment) - Get a list of files from the file list.
- Get SHA256 From File List (Enrichment) - Get a list of SHA256 values from the file list.
- Get Group Info (Enrichment) - Get group information.
- Get Groups (Enrichment) - Get a list of groups.
- Get Policy (Enrichment) - Get policy information.
- Get Simple Custom Detection File Lists (Enrichment) -
- List Computers (Enrichment) - List all computers.
- List Event Types (Enrichment) - Get a list of event types.
- List Events (Enrichment) -Get a list of events matching a query.
- List Vulnerabilities (Enrichment) - Get a list of all vulnerabilities.
- List Application Blocking Lists (Enrichment) - Get the application blocking file lists.
- List Simple Custom Detections Lists (Enrichment) - Get a file list from simple custom detection rules.
- List Indicators (Enrichment) - Get a list of all indicators.
- List Policies (Enrichment) - Get a list of policies.
- Add SHA256 To File List (Containment) - Add a SHA256 value to a file list.
- Delete SHA256 From File List (Containment) - Delete a SHA256 value from a file list.
- Delete Computer (Containment) - Delete a specific computer.
- Isolate Computer (Containment) - Isolate a specific computer.
- Remove Isolation (Containment) - Remove a specific computer from isolation.
Change Log​
- January 29, 2019 - First upload
- May 22, 2020 - Added additional actions
- June 21, 2023 (v1.2) - Updated the integration with Environmental Variables