Cisco XDR: SSX

Gets a list of devices registered with Cisco Security Services Exchange (SSX) using the Cisco XDR SSX proxy.

Target: Platform APIs system target or an HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
- Process the workflow input
- Request a list of devices from XDR
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, return an error

More information about this API: https://visibility.amp.cisco.com/iroh/iroh-sse/index.html#/SSE/get_iroh_iroh_sse_device

XDR - SSX Proxy - List Devices

prod-nam

prod-eu

prod-apjc

Sends a command to a device registered with Cisco Security Services Exchange (SSX) using the Cisco XDR SSX proxy.

Target: Platform APIs system target or an HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
- Generate the JSON and headers for the request
- POST the request JSON to XDR
- Check if the command was executed:
  - If it was, extract the results and set the output variables
  - If it wasn't, return an error

More information about this API: https://visibility.amp.cisco.com/iroh/iroh-sse/index.html#/SSE/post_iroh_iroh_sse_device__device_id__api_proxy