Cisco AMP Integration via API

Purpose

This guide explains how to generate API credentials in the Cisco AMP for Endpoints (now branded Cisco Secure Endpoint) console and how to use them in Logsign USO to ingest endpoint security events and organization audit logs for security analytics and forensic purposes.

Cisco AMP for Endpoints is a cloud-hosted endpoint protection platform. It exposes a REST API (Events API and Audit Log API) rather than syslog; this API poller is the supported way to bring AMP data into Logsign USO. The poller for this integration (cisco_amp_api) already ships with Logsign and pulls from two endpoints: /v1/events (malware detections, quarantine actions, scans, policy updates, isolation, etc.) and /v1/audit_logs (administrative/audit actions performed in the AMP console). Endpoint inventory data (the /v1/computers resource) is not covered by this poller and would require separate development if needed.

Prerequisites

The account you use to generate API credentials must be an administrator in the AMP for Endpoints console with access to the Accounts menu. Standard analyst accounts typically do not see the API Credentials screen.

Credentials should be created with Read-Only scope. Logsign only retrieves data from the Events and Audit Log APIs; it never writes back to AMP, so no write scope is required.

Step 1: Identify Your AMP Cloud Region

Cisco AMP for Endpoints is provisioned in one of three regional clouds, and the API host you must use depends on which region your console lives in. You can tell which region you are in from your console's own URL:

Unlike single-tenant-domain vendors, AMP does not use a per-customer subdomain — only the region changes the host. Enter the full https://... base URL for your region as the Base URL in Logsign; there is no separate tenant path.

Step 2: Create API Credentials in the AMP Console

1. Sign in to your AMP for Endpoints console with an administrator account.
2. Go to Accounts > API Credentials (on some tenants this is under Accounts > Organization Settings > Features > Configure API Credentials).
3. Click New API Credential (also referred to as creating a "3rd Party API Client").
4. Enter an Application name so the credential is identifiable later (for example, "Logsign USO Integration").
5. Select Read-Only as the scope.
6. Click Create to generate the credentials.
7. From the resulting API Key Details screen, copy both the 3rd Party API Client ID and the API Key. Cisco displays these values only once — if you close the panel without copying them, you must generate a new credential pair.

Step 3: Configure the Integration in Logsign USO

After obtaining the region-specific Base URL (Step 1) and the API credentials (Step 2), log in to Logsign USO and add a new Cisco Amp data source. You will be asked for:

Logsign authenticates to the AMP API using HTTP Basic Authentication, sending the Client ID as the username and the API Key as the password on every request — this matches Cisco's documented authentication scheme for the Events and Audit Log APIs, so no additional token exchange step is needed. Logsign then periodically queries both GET /v1/events (using the date field as the sync cursor) and GET /v1/audit_logs (using the created_at field as the sync cursor), tracking each endpoint's position independently so a gap in one does not affect the other. Each event is normalized into a Logsign event, including its event type, affected host and IP, associated file hashes (SHA-256/SHA-1/MD5), file path, disposition, policy ID, and the acting user for audit entries.

Notes and Limits

• On first run, the poller looks back approximately 12 hours by default (configurable via initial_lookback_hours); subsequent runs resume from the last processed record's timestamp.
• Each API request is capped at 500 records per call, matching Cisco's documented per-page limit for these endpoints. Verification note: the current poller implementation issues a single request per polling cycle per endpoint and does not iterate additional pages via the offset parameter that Cisco's API exposes for pagination. In practice this means that if either endpoint produces more than 500 new records within one polling interval (for example, during a large-scale malware outbreak or a mass endpoint scan), only the first 500 are ingested and the remainder for that window are not retried on a later poll, since the cursor advances past them. This is a known limitation to be aware of for high-volume environments.
• If polling stops or credentials are rejected, check whether the API Key or Client ID was deleted, rotated, or had its scope changed in the AMP console. Cisco returns HTTP 401 for authentication failures; generate a fresh Read-Only credential and update the data source in Logsign USO. Cisco also enforces a rate limit (communicated via X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset response headers) and returns HTTP 429 when exceeded.
• This integration covers the AMP Events API and Audit Log API only. Endpoint/computer inventory (the /v1/computers resource) and other AMP console surfaces are not part of this integration and would require a separate connector.
• Make sure the Base URL you enter matches your console's actual region (US, EU, or APJC — see Step 1). Entering the wrong regional host will result in authentication or connectivity failures even with valid credentials, since credentials are tied to the region where your AMP organization is provisioned.