Cisco AMP Antivirus Integration

Overview

You can configure the Cisco AMP antivirus integration to scan files during transfer and detect or block threats.

After the integration is complete, files are scanned at the configured Scan timing. If a threat is detected, the transfer is blocked or an alert is generated according to the selected On detection action. The files to scan are defined by the Scan scope.

The entire process consists of two steps: ① Generate API credentials → ② Configure the integration in the product.

Prerequisites

Before you begin, check the following.

Generate API Credentials

To scan files with Cisco AMP, generate a Client ID and API Key, and check the API Endpoint for your organization's region.

Step 1. Generate API Credentials

Sign in to the Cisco AMP console, go to Accounts → API Credentials, and select New API Credential.

Enter an application name, specify the Scope, and create the credential. The Client ID (API Client ID) and API Key are displayed. These values are shown only once when created, so copy and store them in a secure location.

ℹ️ Treat these credentials like a password. Anyone who knows the values can access your organization's Cisco AMP data, so do not expose them in public repositories or external documents. If they are exposed, delete the credentials and generate new ones.

Step 2. Check the API Endpoint

Check the API endpoint for the region where your organization is located. The endpoint differs by region as follows.

ℹ️ Authentication fails if you use an endpoint for a region different from your organization's region.

Verification

• ✔ The Client ID and API Key have been generated.
• ✔ The API Endpoint for the organization's region has been checked.

Configure the Cisco AMP Integration

Enter the generated credentials and configure the scanning options.

Open the Security settings window to display the screen below.

Step 1. Enter the API Endpoint

Enter the verified regional endpoint in the API Endpoint field. (Example: https://api.amp.cisco.com/...)

Step 2. Enter the Client ID

Enter the generated Client ID in the Client ID field.

Step 3. Enter the API Key

Enter the generated API Key in the API Key field.

Step 4. Select Scan timing

Under Scan timing, select when files should be scanned.

Step 5. Select On detection

Under On detection, select how to handle detected threats.

Step 6. Select Scan scope

Under Scan scope, select the range of files to scan.

Step 7. Save the Settings

After entering the information, click Add to save the integration.

Verification

• ✔ The API Endpoint, Client ID, and API Key have been entered.
• ✔ Scan timing, On detection, and Scan scope have been selected.

Verify the Integration

Verify that the configuration works correctly.

Step 1. Transfer a Test File

Transfer an actual file to verify that scanning is performed. You can verify scanning behavior using a safe test file such as the standard antivirus test file (EICAR).

Step 2. Check the Result

Verify that the configured On detection action works as expected. (For example, Block transfer blocks the transfer, while Alert only generates an alert.)

Verification

• ✔ File scanning has been performed.
• ✔ The configured handling action works as expected.

Setup Complete

The integration is applied when you save the settings. Afterward, transferred files are scanned at the specified timing and scope, and detected threats are handled according to the configured action.

Troubleshooting

If scanning does not work correctly, check the following.