Scripts that cover the basics of interacting with the AMP for Endpoints API

Script to fetch stale GUIDs and delete them

Find duplicate GUIDs in an AMP for Endpoint environment

AMP for Endpoints - Duplicate Fixer. Python script intended to delete duplicated hostnames in AMP4EP portal.

Creates a new event stream to be used with an AMQP client

Download and save the policy.xml for every policy configured in an organization

Examples of parsing specific elements from the JSON returned from the /computers endpoint

Enter a SHA256 return a list of command line arguments associated

Example of handling pagination with the AMP for Endpoint API

AMP for Endpoints - Duplicate Fixer. Python script intended to delete duplicated hostnames.

Get samples from Threat Grid and add the SHA256 to AMP Simple Custom Detection

This script takes a list of OUs and group Guids and call on Cisco Secure Endpoint's (formerly Cisco AMP for Endpoints) API to move computers in OU to desired group.

Document and Restore AMP for Endpoints group memership

Check if a given SHA256 has been executed in an AMP for Endpoints environment

Searches an environment for a process name and collects observed network connections

The basics of interacting with the AMP for Endpoints Endpoint Isolation

Chrome extension to pivot into AMP for Endpoint, Umbrella Investigate, or Threat Grid

Firefox extension to pivot into AMP for Endpoint, Umbrella Investigate, or Threat Grid