Cisco AMP for Endpoints: How to get a clear view (via API) of how many agents are currently installed in the environment(Phone Home Event type)?

[nicholas_bergma]

App: Cisco AMP for Endpoints ver 1.1.0
Splunk: Cloud 6.6.3.2 (ES)

I'm attempting to find a way to get the total number of installed agents; I don't see a "phone home" event type, but is there another way to get a clear view (via API) of how many agents are currently installed in the environment?

My idea is to get this data into Splunk and create dashboards and reports indicating the total number of Agents and which group they're assigned to.

[quihong]

Yes. Check out the REST API MODULAR INPUT App on Splunkbase.

You'll need a create a custom response handler to parse out the data.