Impelix IMPACT Integration
with Cisco AMP
The Impelix IMPACT platform ingests telemetry from your all your security products as well as third-party feeds (threat intelligence, cybersecurity risk, business resilience intelligence, etc.) and delivers event correlation, security control efficacy, and compliance monitoring.
We believe that the more data ingested into IMPACT, the more context you will have regarding security incidents, which will allow effective and efficient incident response and compliance management. Therefore, we encourage and facilitate connecting vendor products telemetry with Impelix IMPACT platform.
Cisco AMP
On the CISCO AMP Console
-
Create an API Key pair in accordance with Cisco guidance:
https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/201121-Overview-of-the-Cisco-AMP-for-Endpoints.htm
Impelix IMPACT Configuration
- Go to Admin > SOAR > Cisco AMP for Endpoints API > Config
- Click the checkbox for Enable the Cisco AMP for Endpoints API
- Paste the Client ID and API Key
- Click the disk icon (Save)
- Click Jobs and go to Artifacts from Cisco AMP
-
Select Triggers, expanding Manual Trigger and Interval Trigger.
- Toggle both to State: ENABLED
- The Interval Trigger is set to 2 hours by default, but you can update it to what best suits your organization. (Recommended: 10 minutes)
- Click the disk icon (Save)
