↳ GitHub sourceConnector

Cisco Secure Endpoint (via Codeless Connector Framework)

Description

The Cisco Secure Endpoint (formerly AMP for Endpoints) data connector provides the capability to ingest Cisco Secure Endpoint [audit logs](https://developer.cisco.com/docs/secure-endpoint/auditlog/) and [events](https://developer.cisco.com/docs/secure-endpoint/v1-api-reference-event/) into Microsoft Sentinel.

Declared status: 1
Declared author / publisher: Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

CiscoSecureEndpointAuditLogsV2_CL CiscoSecureEndpointEventsV2_CL

Declared permissions

Read and Write permissions are required.

Workspace

Workspace

Cisco Secure Endpoint API Credentials/Regions

To create API Credentials and to understand the regions, follow the document link provided here. [Click here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco%20Secure%20Endpoint/Data%20Connectors/README.md).

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

To ingest data from Cisco Secure Endpoint to Microsoft Sentinel, you have to click on Add Account button below, then you get a pop up to fill the details like Email, Organization, Client ID, API Key and Region, provide the required information and click on Connect. You can see the connected organizations/emails in the below grid. >

Add Account

Cisco Secure Endpoint Email

Cisco Secure Endpoint Organization

Cisco Secure Endpoint Client ID

Cisco Secure Endpoint API Key

Cisco Secure Endpoint Region

For example, if your region is https://api.apjc.amp.cisco.com then enter only apjc.amp in the above field. Follow the link provided in the Cisco Secure Endpoint API Credentials/Regions section for better understanding of the regions.

Connect Cisco Secure Endpoint to Microsoft Sentinel

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Cisco Secure Endpoint/Data Connectors/CiscoSecureEndpointLogs_ccp/CiscoSecureEndpointLogs_ConnectorDefinition.json ↗
Commit: 9800e51 ↗
Source identifier: CiscoSecureEndpointLogsCCPDefinition

Additional source files 2

Solutions/Cisco Secure Endpoint/Data Connectors/CiscoSecureEndpointLogs_ccp/CiscoSecureEndpointLogs_ConnectorDefinition.jsonsource ↗Solutions/Cisco Secure Endpoint/Data/Solution_CiscoSecureEndpoint.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.