Getting Data In

Cisco AMP for Endpoints: How to get a clear view (via API) of how many agents are currently installed in the environment(Phone Home Event type)?

nicholas_bergma
New Member

App: Cisco AMP for Endpoints ver 1.1.0
Splunk: Cloud 6.6.3.2 (ES)

I'm attempting to find a way to get the total number of installed agents; I don't see a "phone home" event type, but is there another way to get a clear view (via API) of how many agents are currently installed in the environment?

My idea is to get this data into Splunk and create dashboards and reports indicating the total number of Agents and which group they're assigned to.

0 Karma

quihong
Path Finder

Yes. Check out the REST API MODULAR INPUT App on Splunkbase.

You'll need a create a custom response handler to parse out the data.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...