Cisco AMP

Cyderes supports ingestion of Cisco Advanced Malware Protection (AMP) event data using the API documented here.

Chronicle Data Types

• CISCO_AMP

Caveats / Known Limitations

• API clients are allowed a limited number of requests every hour.
• Each API response will include HTTP headers detailing the status of their rate limit.
• If the limit is overrun, then an HTTP 429 Error will be returned.

HTTP header	Description
X-Rate-Limit-Limit	total allowed requests during the current period
X-Rate-Limit-Remaining	number of remaining requests during the current period
X-Rate-Limit-Reset	number of seconds remaining in the current period

Configuration

• Log in to the AMP for Endpoints Console
• Go to Accounts > API Credentials
• Click New API Credential to generate an API Key and Client ID

Gather Information

Please include the credential's expiration date if available

Please send the following to Cyderes once setup has been completed:

• API Key
• Client ID