Cisco Secure Endpoint

Adds a SHA-256 file hash to an application block list.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Fetch list of block lists
[] Check if the request was successful (if not, output an error)
[] Extract the unique ID of the list we want
[] Check if extraction was successful (if not, output an error)
[] Request the file hash be added to the list
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/file-list-item/

Cisco Secure Endpoint - Add File Hash to Application Block List

prod-nam

prod-eu

prod-apjc

Adds a SHA-256 file hash to a file list in Cisco Secure Endpoint.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Add the hash to the file list
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/file-list-item/

Cisco Secure Endpoint - Add File Hash to File List

Adds a SHA-256 file hash to a simple custom detection list.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Fetch list of file lists
[] Check if the request was successful (if not, output an error)
[] Extract the unique ID of the list we want
[] Check if extraction was successful (if not, output an error)
[] Request the file hash be added to the list
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/file-list-item/

Cisco Secure Endpoint - Add Hash to Simple Custom Detection List

Fetches a computer object from Cisco Secure Endpoint using its GUID.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Query Secure Endpoint for a computer with the given GUID
[] Check if the request was successful:
[]> If it was, extract the computer's JSON and add it to the output variable
[]> If it wasn't, output an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/v1-api-reference-computer/

Cisco Secure Endpoint - Get Computer by GUID

Searches Cisco Secure Endpoint for the given IP address or hostname and returns the endpoint's connector GUID.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Build the search query based on the input provided
[] Query Secure Endpoint for matching computers
[] If a match is found, return its GUID

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/v1-api-reference-computer/

Cisco Secure Endpoint - Get Connector GUID

Fetches events from Cisco Secure Endpoint based on various criteria.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Format the start date
[] Build the query string parameters
[] Request events from Secure Endpoint
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/v1-api-reference-event/

Cisco Secure Endpoint - Get Events

Gets a list of items for a specific file list in Cisco Secure Endpoint.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Fetch the file list items from Secure Endpoint
[] Check if the request was successful:
[]> If it was, extract the list data and set the output variable
[]> If it wasn't, return an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/file-list-item/

Cisco Secure Endpoint - Get File List Items

Searches Cisco Secure Endpoint for the given group and returns its attributes.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Query Secure Endpoint for matching groups
[] If a match is found, return the group's attributes

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/v1-api-reference-group/

Cisco Secure Endpoint - Get Group by Name

Gets a list of simple custom detections file list from Cisco Secure Endpoint.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Fetch the file list items from Secure Endpoint
[] Check if the request was successful:
[]> If it was, extract the list data and set the output variable
[]> If it wasn't, return an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/file-list/

Cisco Secure Endpoint - Get Simple Custom Detections File Lists

Enables isolation for a given computer by its connector GUID.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Get the computer's current isolation status
[] Check whether or not isolation is available for this computer
[]> If not, end the workflow as there's nothing more we can do
[] Request Secure Endpoint update the computer's isolation status
[] Check if the request failed and, if so, return an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/endpoint-isolation/

Cisco Secure Endpoint - Isolate Host

Moves a computer identified by a given connector GUID to a group.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Request Secure Endpoint move the given connector GUID to the specified group
[] Check if the request was successful (if not, return an error)

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/v1-api-reference-computer/

Cisco Secure Endpoint - Move Computer to Group

Removes a SHA-256 file hash from a file list in Cisco Secure Endpoint.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Request the file hash be removed from the list
[] Check if the request was successful:
[]> If it wasn't, output an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/file-list-item/

Cisco Secure Endpoint - Remove File Hash from File List

Searches Cisco Secure Endpoint for computers. If no search options are provided, all computers will be returned.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Build the relative URL
[] Search for matching computers
[] Check if the request was successful:
[]> If it was, attempt to extract the results and set the output variables
[]> If it wasn't, return an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/v1-api-reference-computer/

Cisco Secure Endpoint - Search Computers

Disables isolation for a given computer in Cisco Secure Endpoint using its connector GUID.

Target: Secure Endpoint - v1 or an HTTP Endpoint for "api.amp.cisco.com" with a path of "/v1"

Account Key: None for Secure Endpoint - v1 or HTTP Basic Authentication for an HTTP Endpoint

Steps:
[] Get the computer's current isolation status
[] Check whether or not isolation is available for this computer:
[]> If not, end the workflow as there's nothing more we can do
[] Request Secure Endpoint update the computer's isolation status
[] Check if the request failed and, if so, return an error

More information about this API can be found in Secure Endpoint's API documentation: https://developer.cisco.com/docs/secure-endpoint/endpoint-isolation/