Cisco Advanced Malware Protection

Cisco Advanced Malware Protection (AMP) includes threat intelligence, sandboxing, and malware blocking to detect, contain, and remove malware.

For more information about Cisco and Lucidum, see https://lucidum.io/cisco/.

Creating an API Key for Cisco Advanced Malware Protection

Before configuring the Cisco AMP connector in Lucidum, you must first create an API Key. Lucidum will use the API key to access the Cisco AMP API.

1. Log in to the admin panel of Cisco AMP.

2. Click the Accounts menu and choose Business Page.

3. Click Edit

4. Under features, click the Regenerate… button beside "3rd Party API Access" to generate the client ID and secure API Key.

5. View and copy the client ID and API key.

Configuring the Connector for Cisco Advanced Malware Protection

To configure Lucidum to ingest data from Cisco AMP:

1. Log in to Lucidum.

2. In the left pane, click Connector.

3. In the Connector page, click Add Connector.

4. Scroll until you find the Connector you want to configure. Click Connect. The Settings page appears.

5. In the Settings page, enter the following:

   • URL (required): The URL of the Cisco AMP API, for example, https://api.amp.cisco.com.

   • Client ID(required) – The credentials for a user account that has the read permissions to fetch assets.

   • API Key (required) – The credentials for a user account that has the read permissions to fetch assets.

   • Verify SSL. For future use.

6. To test the configuration, click Test.

   • If the connector is configured correctly, Lucidum displays a list of services that are accessible with the connector.

   • If the connector is not configured correctly, Lucidum displays an error message.