EDR / XDR integration
Automate Cisco Secure Endpoint EDR / XDR with plain language
Read Cisco Secure Endpoint computers, events and groups, and move a compromised host into an isolation group.
What you can do
Cisco Secure Endpoint (AMP for Endpoints) — v1 REST API
- List enrolled computers with connector state
- Read detection events and compromises
- Start host isolation
Connection: basic authentication against https://api.amp.cisco.com. Credentials are encrypted at rest, or prompted per action if you prefer never to store them.
Example
Ask in plain English
Prompt: “Isolate the laptop with the latest critical detection in Cisco Secure Endpoint”
Result: VernacSecure SuperBot™ reads recent detections, confirms the device and isolates it, with a full audit entry.
Read actions
- Fetch computers — Lists enrolled computers.
- Fetch events — Lists recent detection events.
- Fetch groups — Lists policy groups.
Write actions
- Isolate host — Starts isolation for the named connector GUID.
Related edr automation pages
Bitdefender GravityZone · Broadcom Symantec Endpoint Security · Check Point Harmony Endpoint · CrowdStrike Falcon · Cybereason Defense Platform · ESET Inspect