Skip to main content

Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

Table of Contents

Cisco AMP for Endpoints Cloud Connector

Cisco Advance Malware Protection (AMP) is a malware analysis and protection solution that provides cloud-based antivirus and endpoint detection and response. Using cloud-based analytics, Cisco AMP monitors each file in the network and offers visibility and control over sophisticated, targeted, and continual malware threats. For more information see the Cisco AMP for Endpoints documentation.

Prerequisites to Configure the Cisco AMP for Endpoints Connector

Before you configure the Cisco AMP for Endpoints connector you must complete the following prerequisites:

  • Obtain the API client ID

  • Obtain an API key

Obtaining the API Client ID and API Key

Cisco AMP APIs are authenticated via application keys. You must obtain the API key and client ID to use while configuring the Cisco AMP for Endpoints connector.

To obtain an application key and client ID:

  1. Log in to Cisco AMP console by accessing https://console.amp.cisco.com as an administrator.

  2. Navigate to Accounts > API Credentials.

  3. Click New API Credential to create a new API key and client ID.

  4. In the Application Name box, specify a name for the application.

  5. In the Scope area, select the permission Read-only.

  6. Click Create.

  7. The API Key Details section displays third party API client ID and the API key.

The API credentials help other programs retrieve and modify the Cisco AMP for Endpoints data. The API credentials appear only once. If you lose the API credentials, you must create new API credentials. Note the values for the third-party API client ID and API key represented by letters and numbers. Use the API key and client ID while configuring the Cisco AMP Connector on the Exabeam Cloud Connector platform.

Configure the Cisco AMP for Endpoints Connector

Cisco Advance Malware Protection (AMP) is a malware analysis and protection solution that provides cloud-based antivirus and endpoint detection and response. Using cloud-based analytics, Cisco AMP monitors each file in the network and offers visibility and control over sophisticated, targeted, and continual malware threats. For more information see the Cisco AMP for Endpoints documentation.

The following table displays audit source API and security events supported by the connector.

Audit Source: API

Service or Module Covered

Events Included

Events

Any

All

Table 3. Audit source API and security events supported by the connector


To configure the Cisco AMP connector to import data into the Exabeam Cloud Connector platform:

  1. Complete the Prerequisites to Configure the Cisco AMP for Endpoints Connector.

  2. Log in to the Exabeam Cloud Connectors platform with your registered credentials.

  3. Navigate to Settings > Accounts > Add Account.

  4. Click Select Service to Add, then select Cisco AMP from the list.

  5. In the Accounts section, enter the required information.

    1. Account Name – Specify a name for the Cisco AMP connector. For example, Corporate AMP for Endpoints.

    2. (optional) Description – Describe the Cisco AMP connector. For example, Cisco Advanced Malware Protection for endpoint protection, detection, and response.

    3. Client ID – Enter the client ID that you obtained while completing prerequisites.

    4. Client Key – Enter the API key that you obtained while completing prerequisites.

    5. Region – Select the region EU or US based on the AMP server that you use. If you use https://console.amp.cisco.com , select US. If you use https://console.eu.amp.cisco.com, select EU.

      Note

      Required fields are indicated with a red bar.

  6. To confirm that the Exabeam Cloud Connector platform communicates with the service, click Test Connection.

  7. Click Done to save your changes. The cloud connector is now set up on the Exabeam Cloud Connector platform.

  8. To ensure that the connector is ready to send and collect data, Start the connector and check that the status shows OK.