Cisco AMP Antivirus Integration

Overview#

You can configure the Cisco AMP antivirus integration to scan files during transfer and detect or block threats.

After the integration is complete, files are scanned at the configured Scan timing. If a threat is detected, the transfer is blocked or an alert is generated according to the selected On detection action. The files to scan are defined by the Scan scope.

The entire process consists of two steps: ① Generate API credentials → ② Configure the integration in the product.

Prerequisites#

Before you begin, check the following.

Generate API Credentials#

To scan files with Cisco AMP, generate a Client ID and API Key, and check the API Endpoint for your organization's region.

Step 1. Generate API Credentials#

Sign in to the Cisco AMP console, go to Accounts → API Credentials, and select New API Credential.

Enter an application name, specify the Scope, and create the credential. The Client ID (API Client ID) and API Key are displayed. These values are shown only once when created, so copy and store them in a secure location.

ℹ️ Treat these credentials like a password. Anyone who knows the values can access your organization's Cisco AMP data, so do not expose them in public repositories or external documents. If they are exposed, delete the credentials and generate new ones.

Step 2. Check the API Endpoint#

Check the API endpoint for the region where your organization is located. The endpoint differs by region as follows.

ℹ️ Authentication fails if you use an endpoint for a region different from your organization's region.

Verification#

• ✔ The Client ID and API Key have been generated.
• ✔ The API Endpoint for the organization's region has been checked.

Configure the Cisco AMP Integration#

Enter the generated credentials and configure the scanning options.

Open the Security settings window to display the screen below.

Step 1. Enter the API Endpoint#

Enter the verified regional endpoint in the API Endpoint field. (Example: https://api.amp.cisco.com/...)

Step 2. Enter the Client ID#

Enter the generated Client ID in the Client ID field.

Step 3. Enter the API Key#

Enter the generated API Key in the API Key field.

Step 4. Select Scan timing#

Under Scan timing, select when files should be scanned.

Step 5. Select On detection#

Under On detection, select how to handle detected threats.

Step 6. Select Scan scope#

Under Scan scope, select the range of files to scan.

Step 7. Save the Settings#

After entering the information, click Add to save the integration.

Verification#

• ✔ The API Endpoint, Client ID, and API Key have been entered.
• ✔ Scan timing, On detection, and Scan scope have been selected.

Verify the Integration#

Verify that the configuration works correctly.

Step 1. Transfer a Test File#

Transfer an actual file to verify that scanning is performed. You can verify scanning behavior using a safe test file such as the standard antivirus test file (EICAR).

Step 2. Check the Result#

Verify that the configured On detection action works as expected. (For example, Block transfer blocks the transfer, while Alert only generates an alert.)

Verification#

• ✔ File scanning has been performed.
• ✔ The configured handling action works as expected.

Setup Complete#

The integration is applied when you save the settings. Afterward, transferred files are scanned at the specified timing and scope, and detected threats are handled according to the configured action.

Troubleshooting#

If scanning does not work correctly, check the following.