> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cisco Advanced Malware Protection (AMP)

> Cisco AMP is an intelligence-powered, integrated, enterprise-class advanced malware analysis and protection solution.

<Tip>
  You can connect to a third-party application using the integration functionality, and then use your playbook to call that connection.
</Tip>

### Cisco AMP Events Overview

This Integration retrieves detailed security event information from Cisco AMP, including threat details, affected systems, and timestamps. Use this skill to monitor security incidents, analyze threats, and maintain system integrity.

### Cisco AMP Pre-requisites

> User must have a valid Cisco Secure Endpoint (AMP) subscription & [Console](https://console.amp.cisco.com) login.
>
> Administrator/root access on the machines (for installing AMP connectors/agents).
>
> Network/firewall must allow communication to Cisco AMP cloud servers.
>
> ✅ **Network Firewall/Proxy Allow List:**
>
> | Region | Domain                    |
> | ------ | ------------------------- |
> | US     | `api.amp.cisco.com `      |
> | EU     | `api.eu.amp.cisco.com `   |
> | APJC   | `api.apjc.amp.cisco.com ` |

### Create Cisco AMP API Credentials

<Note>
  To ingest the logs into AirMDR, User must follow the steps stated below to define API credentials for AirMDR
</Note>

<Steps>
  <Step title="Log into Cisco AMP for Endpoints Console">
    1. Login to the [Cisco Security Cloud Sign On](https://console.amp.cisco.com/api_credentials).
    2. Sign in with your Cisco SecureX or AMP credentials and click **Continue**.
  </Step>

  <Step title="Create API Credentials" stepNumber="2">
    1. Inside the console navigate on the left-hand side menu, click drop-downlist **Accounts → API Credentials**.
    2. On the **API Credentials** page, click the **“Create”** button (top right corner).

           <Check>
             Fill application name as `airmdr-siem`.
           </Check>
  </Step>

  <Step title="API Scope and Permission" stepNumber="3">
    Choose either *Read-Only* or *Read-Write* permission.

    <Info>
      In case of *Read-Only*, User must setup an event stream and share the credentials for the event stream in addition to API credentials
    </Info>

    <Accordion title="Create Event Stream" description="Steps to create event stream (in case read only credentials are shared)" defaultOpen>
      <Info>
        For creating event streams, User must use API credentials with both Read-Write permission
      </Info>

      <Check>
        Run the following curl after replacing your credentials in url
      </Check>

      <Tabs>
        <Tab title="Mac/Linux curl">
          ```
          curl --location --request POST 'https://{your_client_id}:{your_api_key}@api.amp.cisco.com/v1/event_streams' \
          --header 'Accept: application/json' \
          --header 'Content-Type: application/json' \
          --data '{
            "name": "airmdr-ingestion-stream"
          }'
          ```
        </Tab>

        <Tab title="Windows curl">
          ```
          curl --location --request POST "https://{your_client_id}:{your_api_key}@api.amp.cisco.com/v1/event_streams" ^
          --header "Accept: application/json" ^
          --header "Content-Type: application/json" ^
          --data "{ \"name\": \"airmdr-ingestion-stream\" }"
          ```
        </Tab>
      </Tabs>

      * In response User will get a field called `amqp_credentials`

      ```
      {'version': 'v1.2.0', 'metadata': {'links': {'self': 'https://api.amp.cisco.com/v1/event_streams'}}, 'data': {'id': 23312, 'name': 'airmdr-ingestion-stream', 'amqp_credentials': {'user_name': 'zzz-zz', 'queue_name': 'yyy-yyy', 'password': 'xxx-xxx-xxx', 'host': 'export-streaming.amp.cisco.com', 'port': '443', 'proto': 'amqps'}}}
      ```

      <Tabs>
        <Tab title="Sample Response Data">
          ```
          import requests
          import json

          your_client_id = 
          your_api_key = 

          url = f"https://{your_client_id}:{your_api_key}@api.amp.cisco.com/v1/event_streams"

          payload = json.dumps({
            "name": "airmdr-ingestion-stream"
          })

          headers = {
            'Accept': 'application/json',
            'Content-Type': 'application/json'
          }

          response = requests.request("POST", url, headers=headers, data=payload)
          print(response.json())
          ```
        </Tab>
      </Tabs>

      <Check>
        <Icon icon="envelope" /> Email the data field of response that contains queue credentials and name to AirMDR.
      </Check>
    </Accordion>
  </Step>

  <Step title="API Credentials">
    Click **Create**.

    <Warning>
      This is the only time the **API Client ID** and **API Key** will be displayed. \
      Copy and securely store both values somewhere like a password manager.
    </Warning>
  </Step>
</Steps>

<Check>
  <Icon icon="envelope" /> Share the **API Key** and **API Client ID** securely to AirMDR.\
  (or) \
  Self Configure Cisco AMP API in the AirMDR Integrations Dashboard.
</Check>

### Skills Provided by this Integration

| Skill ID                      | Purpose                                                                                                                                                                                                                |
| :---------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Retrieve Cisco AMP Events** | Retrieve detailed security event information from Cisco AMP, including threat details, affected systems, and timestamps. Use this skill to monitor security incidents, analyze threats, and maintain system integrity. |

<Tip>
  To view the details of Input Parameters and Output for the respective skills

  * Go to [AirMDR → Cisco AMP](https://app.airmdr.com/integrations?search=Cisco+AMP\&provider=f3c701f2-a808-482c-ab3c-473391eae6b2) Integration page.
  * Select the **Skills** tab and click on the required listed skills.
</Tip>

### Configure Cisco AMP API in AirMDR Integrations Dashboard

1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login.**

   <img src="https://mintcdn.com/airmdr/wnBXbVlE7mmN9W6R/images/Datadog11.png?fit=max&auto=format&n=wnBXbVlE7mmN9W6R&q=85&s=94afec6835b90abcec516831e584184f" alt="Datadog11 Pn" width="443" height="568" data-path="images/Datadog11.png" />
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **Integrations.**

   <img src="https://mintcdn.com/airmdr/wnBXbVlE7mmN9W6R/images/Datadog9.png?fit=max&auto=format&n=wnBXbVlE7mmN9W6R&q=85&s=314cbc6e406f70453a592159150f36e2" alt="Datadog9 Pn" width="311" height="473" data-path="images/Datadog9.png" />
3. Use the search option, enter the keyword "**Cisco AMP**", select the **Connections** tab, and click **Add New Connection**.

   <img src="https://mintcdn.com/airmdr/LWiqSTk4KBjTs5fz/images/CiscoAMP3.png?fit=max&auto=format&n=LWiqSTk4KBjTs5fz&q=85&s=58d6d8b38e36aa7d96a43a344dc97e0f" alt="Cisco AMP3 Pn" width="2088" height="1234" data-path="images/CiscoAMP3.png" />
4. Enter an unique name to the Instance (e.g., `your org name-Cisco AMP`) and brief **Description** to easily identify the user connection by AirMDR.
5. Enter the generated **API Key** and **API Client ID** in the Authentication Details field params, and click **Save.**

   <img src="https://mintcdn.com/airmdr/LWiqSTk4KBjTs5fz/images/CiscoAMP4.png?fit=max&auto=format&n=LWiqSTk4KBjTs5fz&q=85&s=540587c31058fa98875bcb7e414fb805" alt="Cisco AMP4 Pn" width="1494" height="1444" data-path="images/CiscoAMP4.png" />

### Evaluate Cisco AMP API Key & Client ID

Open **cURL** and run the following command to check if your API Key is working:

```

curl -u 'YOUR_CLIENT_ID:YOUR_API_KEY' 'https://api.amp.cisco.com/v1/computers'
```

**🛠 Replace:**

* `YOUR_CLIENT_ID` → with your real Client ID
* `YOUR_API_KEY` → with your real API Key

<Tip>
  If your AMP instance is **in Europe or APJC**, the URL will be different:

  * US: `https://api.amp.cisco.com`
  * EU: `https://api.eu.amp.cisco.com`
  * APJC: `https://api.apjc.amp.cisco.com`

  Use the endpoint that matches your region! (You can find it in your AMP dashboard under API Credentials.)
</Tip>

**🔥 Expected Outputs:**

| Result             | Meaning                                          |
| :----------------- | :----------------------------------------------- |
| `200 OK`           | 🎯 Success! Your API key works!                  |
| `401 Unauthorized` | 🚫 Invalid credentials — check Client ID/API Key |

Success:

```

Status Code: 200
Response Body:
{
  "data": [...],
  "metadata": {...}
}
✅ API key and client ID are working!
```

Invalid Credentials

```

Status Code: 401
Response Body:
{
  "errors": [
    {
      "message": "Unauthorized"
    }
  ]
}
❌ Failed to authenticate. Please check your credentials and permissions.
```