Cisco AMP

Integrations

Impelix IMPACT Integration
with Cisco AMP

The Impelix IMPACT platform ingests telemetry from your all your security products as well as third-party feeds (threat intelligence, cybersecurity risk, business resilience intelligence, etc.) and delivers event correlation, security control efficacy, and compliance monitoring.

We believe that the more data ingested into IMPACT, the more context you will have regarding security incidents, which will allow effective and efficient incident response and compliance management. Therefore, we encourage and facilitate connecting vendor products telemetry with Impelix IMPACT platform.

On the CISCO AMP Console

Create an API Key pair in accordance with Cisco guidance:
https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/201121-Overview-of-the-Cisco-AMP-for-Endpoints.htm

Impelix IMPACT Configuration

Go to Admin > SOAR > Cisco AMP for Endpoints API > Config
Click the checkbox for Enable the Cisco AMP for Endpoints API
Paste the Client ID and API Key
Click the disk icon (Save)
Click Jobs and go to Artifacts from Cisco AMP
Select Triggers, expanding Manual Trigger and Interval Trigger.
- Toggle both to State: ENABLED
The Interval Trigger is set to 2 hours by default, but you can update it to what best suits your organization. (Recommended: 10 minutes)
Click the disk icon (Save)

The Next Evolution of Security Operations

Avoid alert noise, high cost of data ingestion, and incident response complexity.

Move to our Automated SecOps and Enterprise Risk Management Platform.

✔︎ Respond ✔︎ Investigate ✔︎ Prevent ✔︎ Comply

Schedule a Demo