Integrate Cisco AMP Antivirus

Overview

You can integrate Cisco AMP Antivirus to scan files during Transfer and detect or block potential threats.

Once configured, files are scanned according to the selected Scan timing. If a threat is detected, the configured On detection action is applied to block the Transfer or generate an alert. The files to be scanned are determined by the selected Scan scope.

The overall process consists of the following steps:

① Generate API Credentials → ② Configure the Integration in the Product

Prerequisites

Before you begin, verify the following requirements.

Generate API Credentials

To scan files with Cisco AMP, generate a Client ID and API Key, and verify the API Endpoint for your organization's region.

Step 1. Generate API Credentials

Sign in to the Cisco AMP Console, navigate to Accounts → API Credentials, and select New API Credential.

Enter the application name, configure the required scope, and generate the credentials. The Client ID (API Client ID) and API Key are displayed only once during creation, so copy and store them securely.

Treat these credentials as passwords. Anyone with access to them can access your organization's Cisco AMP data. Do not expose them in public repositories or external documentation. If the credentials are compromised, delete them and generate new ones.

Step 2. Verify the API Endpoint

Verify the API Endpoint for your organization's region.

Authentication fails if an API Endpoint for a different region is used.

Verification

✔ A Client ID and API Key have been generated.

✔ The API Endpoint for the organization's region has been verified.

Configure Cisco AMP Integration

Enter the generated credentials and configure the scanning options.

When you open the Security configuration page, the following screen is displayed.

Step 1. Enter the API Endpoint

Enter the regional API Endpoint verified in the "Generate API Credentials" section into the API Endpoint field (for example, https://api.amp.cisco.com/...).

Step 2. Enter the Client ID

Enter the Client ID generated in the "Generate API Credentials" section into the Client ID field.

Step 3. Enter the API Key

Enter the API Key generated in the "Generate API Credentials" section into the API Key field.

Step 4. Select Scan Timing

Select when files should be scanned in Scan timing.

Step 5. Select On Detection

Select how the system should respond when a threat is detected in On detection.

Step 6. Select Scan Scope

Select which files should be scanned in Scan scope.

Step 7. Save the Configuration

After completing the configuration, click Add to save the integration.

Verification

✔ The API Endpoint, Client ID, and API Key have been entered.

✔ The Scan timing, On detection, and Scan scope options have been selected.

Verify the Integration

Verify that the integration is operating correctly.

Step 1. Perform a Test Transfer

Transfer a file to verify that scanning is performed. You can safely verify the scanning behavior using a standard antivirus test file such as EICAR.

Step 2. Verify the Result

Verify that the configured On detection action is applied correctly (for example, Block transfer blocks the Transfer, while Alert only generates a warning).

Verification

✔ File scanning has been performed.

✔ The configured detection action is applied correctly.

Configuration Complete

After the configuration is saved, the integration becomes active.

From this point forward, transferred files are scanned according to the configured timing and scope. If a threat is detected, the configured action is applied automatically.

Troubleshooting

If scanning does not operate correctly, verify the following.