Cisco Secure Endpoint - Audit
Cisco Secure Endpoint - Event
Overview
Cisco Secure Endpoint is a single-agent solution that provides comprehensive protection, detection, response, and user access coverage to defend against threats to your endpoints. Cisco Secure Endpoint can detect and neutralize malicious activity in real time, ensuring robust protection of your digital assets.
This integration ingests the following logs:
- Audit: Audit logs provide activities performed by a user in the Cisco Secure Endpoint console.
- Event: Event logs are essential for tracking security events, enabling quick detection, response, and analysis of potential threats.
The Cisco Secure Endpoint integration provides out-of-the-box dashboards so you can gain insights into the Cisco Secure Endpoint’s audit and event logs, enabling quick and necessary actions. Additionally, out-of-the-box detection rules are available to help you monitor and respond to potential security threats effectively.
Disclaimer: Your use of this integration, which may collect data that includes personal information, is subject to your agreements with Datadog. Cisco is not responsible for the privacy, security or integrity of any end-user information, including personal data, transmitted through your use of the integration.
Setup
Generate API credentials in Cisco Secure Endpoint
- Log in to your Cisco Secure Endpoint Console and navigate to the Menu Panel on the left side.
- Select
Administration, then select Organization Settings. - Click
Configure API Credentials under the Features section to generate new API credentials. - Click on the
New API Credentials button located at the right side under the Legacy API Credentials (version 0 and 1) section. - Add the following information in the pop-up modal:
- Application Name: Any preferable name.
- Scope: Select
Read-only. - Click
Create. - Once you click Create, the redirected page will display the client ID (like a third party API client ID) and API Key values.
Connect your Cisco Secure Endpoint account to Datadog
Add your Cisco Secure Endpoint credentials.
| Parameters | Description |
|---|
| API Domain Name | The API domain name for Cisco Secure Endpoint Cloud is “api.<region>.amp.cisco.com”. Adjust the “region” part based on the region of the Cisco Secure Endpoint server. If Cisco Secure Endpoint is hosted on VPC (Virtual Private Cloud), directly provide the API domain name. |
| Client ID | Client ID from Cisco Secure Endpoint. |
| API Key | API key from Cisco Secure Endpoint. |
| Get Endpoint Details | Keep the default value of “true” to collect endpoint metadata for Cisco Secure Endpoint event logs. Otherwise, set this to “false”. |
Click the Save button to save your settings.
Data Collected
Logs
The Cisco Secure Endpoint integration collects and forwards Cisco Secure Endpoint audit and event logs to Datadog.
Metrics
The Cisco Secure Endpoint integration does not include any metrics.
Events
The Cisco Secure Endpoint integration does not include any events.
Support
For further assistance, contact Datadog Support.
