topic How to configure Cisco AMP for Endpoints Events input in Getting Data In

How to configure Cisco AMP for Endpoints Events input

Kayoko — Wed, 07 Nov 2018 07:44:30 GMT

I tried to configure the AMP for Endpoints API Access on the Cisco AMP for Endpoints Events input app. However the configuration information is not working properly.
I got error message which is stated "Warning! We couldn’t retrieve the information from API with provided credentials. Please make sure the API host is accessible or re-configure the input with correct credentials."

AMP for Endpoints API Host: api.amp.cisco.com
API Client ID : entered the client ID generated by Cisco AMP (API Client have read and write scope)
API Key：　entered the secret API key generated by Cisco AMP

If there is any instruction for setting of Cisco AMP for Endpoints Events input app?

Best Regards,

Re: How to configure Cisco AMP for Endpoints Events input

aamer86 — Tue, 19 Feb 2019 13:09:18 GMT

Hi I just resolved this and thought to share it

first thing I noticed is
AMP for Endpoints API Host should be api.eu.amp.cisco.com

Try this as a start

if it doesn't work let me know as i got it working

Re: How to configure Cisco AMP for Endpoints Events input

aamer86 — Tue, 19 Feb 2019 13:09:31 GMT

Hi I just resolved this and thought to share it

first thing I noticed is
AMP for Endpoints API Host should be api.eu.amp.cisco.com

Try this as a start

if it doesn't work let me know as i got it working

Re: How to configure Cisco AMP for Endpoints Events input

jdamico1092 — Fri, 31 May 2019 18:15:01 GMT

I'm also experiencing the same issue. I've verified connectivity and key access by using the curl command. Both return the expected output. Any ideas? The endpoint I'm using is api.amp.cisco.com which should be correct.

Re: How to configure Cisco AMP for Endpoints Events input

troja007 — Tue, 13 Aug 2019 13:32:45 GMT

Any solution for this?? My splunk instance shows the same problem.