Skip to content

CiscoAMPforEndpoints#

AMPforEndpoints_IsolationStop#

Author: Cisco Security
License: MIT
Version: 1.0
Supported data types:
- thehive:case_artifact
Registration required: N/A
Subscription required: N/A
Free subscription: N/A
Third party service: https://www.cisco.com/site/us/en/products/security/endpoint-security/secure-endpoint/index.html

Description#

Stop host isolation for an AMP for Endpoints connector

Configuration#

amp_cloud FQDN of the AMP for Endpoints cloud to interact with
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
client_id Client ID for AMP for Endpoints
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
api_key API Key for AMP for Endpoints
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True

AMPforEndpoints_SCDAdd#

Author: Cisco Security
License: MIT
Version: 1.0
Supported data types:
- thehive:case_artifact
Registration required: N/A
Subscription required: N/A
Free subscription: N/A
Third party service: https://www.cisco.com/site/us/en/products/security/endpoint-security/secure-endpoint/index.html

Description#

Add a SHA256 to an AMP for Endpoints Simple Custom Detection list

Configuration#

amp_cloud FQDN of the AMP for Endpoints cloud to interact with
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
client_id Client ID for AMP for Endpoints
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
api_key API Key for AMP for Endpoints
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
scd_guid AMP for Endpoints Simple Custom Detection GUID
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True

AMPforEndpoints_MoveGUID#

Author: Cisco Security
License: MIT
Version: 1.0
Supported data types:
- thehive:case_artifact
Registration required: N/A
Subscription required: N/A
Free subscription: N/A
Third party service: https://www.cisco.com/site/us/en/products/security/endpoint-security/secure-endpoint/index.html

Description#

Move an AMP for Endpoints connector GUID to a different Group

Configuration#

amp_cloud FQDN of the AMP for Endpoints cloud to interact with
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
client_id Client ID for AMP for Endpoints
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
api_key API Key for AMP for Endpoints
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
group_guid AMP for Endpoints Group GUID for the group connectors will be moved to
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True

AMPforEndpoints_SCDRemove#

Author: Cisco Security
License: MIT
Version: 1.0
Supported data types:
- thehive:case_artifact
Registration required: N/A
Subscription required: N/A
Free subscription: N/A
Third party service: https://www.cisco.com/site/us/en/products/security/endpoint-security/secure-endpoint/index.html

Description#

Remove a SHA256 to an AMP for Endpoints Simple Custom Detection list

Configuration#

amp_cloud FQDN of the AMP for Endpoints cloud to interact with
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
client_id Client ID for AMP for Endpoints
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
api_key API Key for AMP for Endpoints
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
scd_guid AMP for Endpoints Simple Custom Detection GUID
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True

AMPforEndpoints_IsolationStart#

Author: Cisco Security
License: MIT
Version: 1.0
Supported data types:
- thehive:case_artifact
Registration required: N/A
Subscription required: N/A
Free subscription: N/A
Third party service: https://www.cisco.com/site/us/en/products/security/endpoint-security/secure-endpoint/index.html

Description#

Start host isolation for an AMP for Endpoints connector

Configuration#

amp_cloud FQDN of the AMP for Endpoints cloud to interact with
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
client_id Client ID for AMP for Endpoints
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
api_key API Key for AMP for Endpoints
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
unlock_code Custom unlock code used to stop isolation from the endpoint (Maximum 24 characters)
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required False