---
title: "Cisco AMP"
slug: "cisco-amp"
tags: ["Self Service Ingestion"]
updated: 2026-02-28T23:04:25Z
published: 2026-02-28T23:04:25Z
canonical: "docs.hunters.ai/cisco-amp"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cisco AMP

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

****TL;DR****

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Cisco AMP event stream | ✅ |  | ✅ |  | cisco_amp_events | NDJSON | API |

---

## Overview

![cisco secure endpoint logo](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/cisco%20secure%20endpoint%20logo.png)[Cisco AMP](https://www.cisco.com/site/us/en/products/security/endpoint-security/secure-endpoint/index.html), now Cisco Secure Endpoint, is a comprehensive endpoint security solution designed to prevent, detect, and respond to cyber threats. It combines advanced threat intelligence, machine learning, and behavioral analysis to protect endpoints from malware, ransomware, and other sophisticated attacks. AMP continuously monitors file activity, offering real-time threat detection and retrospective analysis to quickly identify and remediate vulnerabilities. Integrated with Cisco's security ecosystem, it provides seamless visibility and protection across networks, making it a robust tool for organizations seeking proactive and adaptive endpoint defense.

## Supported data types

### Cisco AMP event stream

**Table name:** `cisco_amp_events`

Cisco AMP event stream logs capture and record detailed information about security-related events detected by Cisco AMP. These logs include data on file and network activities, threat detections, and other security events, aiding in the analysis, investigation, and response to potential cybersecurity threats.

## Send data to Hunters

Hunters supports the collection of logs from Cisco AMP using API.

**To connect Cisco AMP logs:**

1. Follow [this guide](https://api-docs.amp.cisco.com/api_actions/details?api_action=POST+%2Fv1%2Fevent_streams&api_host=api.amp.cisco.com&api_resource=EventStream&api_version=v1) to gather the following information from Cisco:
  - Host
  - User Name
  - Password
  - Queue Name
2. Complete the process on the Hunters platform, following [this process](https://hunters.document360.io/docs/connect-a-data-source).

## Expected format

Logs are expected in NDJSON format.

```json
{
  "id": 1000000000000000000,
  "timestamp": 1609867870,
  "timestamp_nanoseconds": 386000000,
  "date": "2021-01-05T17:31:10+00:00",
  "event_type": "Scan Started",
  "event_type_id": 100000000,
  "connector_guid": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
  "group_guids": [
    "ffffffff-1111-2222-3333-444444444444"
  ],
  "computer": {
    "connector_guid": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
    "hostname": "host01.corp.example.local",
    "external_ip": "198.51.100.25",
    "active": true,
    "network_addresses": [
      {
        "ip": "192.0.2.10",
        "mac": "00:00:5e:00:53:01"
      }
    ],
    "links": {
      "computer": "https://api.example.com/v1/computers/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
      "trajectory": "https://api.example.com/v1/computers/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/trajectory",
      "group": "https://api.example.com/v1/groups/ffffffff-1111-2222-3333-444444444444"
    }
  },
  "scan": {
    "description": "Flash Scan"
  }
}
```