Supported Cortex XSOAR versions: 6.8.0 and later.
This is the Cisco AMP event collector integration for Cortex XSIAM. This integration was integrated and tested with version v1 of CiscoAMPEventCollector.
Navigate to Settings > Integrations > Servers & Services.
Search for Cisco AMP Event Collector.
Click Add instance to create and configure a new integration instance.
Parameter Required Server URL (e.g., https://some_url.com) True Client ID True API Key True Max events number per fetch False Trust any certificate (not secure) False Use system proxy settings False
Click Test to validate the URLs, token, and connection.
You can execute these commands from the Cortex XSIAM CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
Gets events from Cisco AMP.
|If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.
|Maximum results to return.
|From date to get events from.
There is no context output for this command.