Why does the AMP for endpoints API require the "write" access?

[hrithiktej]

Why does the AMP for endpoints API require the "write" access? I am afraid of the APP making changes to the events in AMP console. Will it delete or resolve the alerts if i give the WRITE access to the APP?

[powerst · Accepted solution]

I had the same question and reached out to the app developer through my Cisco SE.

When you configure an input in the app, it needs to do a POST to the AMP API to configure the AMQPS event stream.

Once you've configured your inputs and they're all posted to your AMP instance, you can switch the app to a read-only credential and it continues to work.

Tested this myself and it so far it's been working as described. If I need to modify an input I temporarily swap in a RW API credential and go back to RO after the modification is made.

[powerst]

Small update to this.

Do not delete the RW API credential set from the AMP console. If you do, it will delete any event streams created using that credential set.

Also, input in the app will continue to use RW credentials even after you change configuration to different RO credential. You'll need to edit local/inputs and update the api_id and api_key for your created input manually if you want to be sure those keys aren't stored anywhere.

[hrithiktej]

cool thanks for the update

[linuxnoobcast]

Can we have another app with read only rights? ,Can we have a repose on this? from the developer? it would be better if we have another app that requires read only rights.

[hrithiktej]

I was unable to get it to work with read only access and then i explained my AMP admin and they got me both access and from last 4 months we are pulling data into Splunk and can say that it is safe to have read and write both. But i agree ideally it should work with read only access.

I have not tested whether it requires read write initially or whether throughout

[tomasmoser]

I have the same "issue". My CSIRT team that is in charge of AMP deployment will give me only RO-only access. Can we go about it somehow? Perhaps R/W user is only necessary for initial set-up and we can change it to RO for future use? This is really a limitation 😞

Tomas