Cisco Advanced Malware Protection (AMP) provides threat intelligence, sandboxing, and malware blocking to detect, contain, and remove malware. The Balbix integration with Cisco AMP ingests infrastructure assets and associated vulnerabilities discovered by Cisco AMP.
Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.
Integration summary
This table provides a summary of the Balbix integration for the Cisco AMP connector.
Integration Type | Fetch: An inbound API integration used to fetch infrastructure assets and vulnerabilities. |
Types of Assets Fetched | Host devices including servers, virtual machines, desktops, laptops. |
Types of Data Fetched | Asset names, hardware information, interface information (MAC address, IP address), OS information, software information, associated vulnerabilities. |
Prerequisites
To configure the Balbix connector, first create Cisco AMP API credentials with the appropriate permissions. These credentials are required for completing the configuration process. Here are the steps you need to complete:
Configure API credentials: Configure API credentials to generate the client ID and API key.
Configure API credentials
Log in to your Cisco AMP Console.
Go to Accounts > Organization Settings.
Click Configure API Credentials to generate the client ID and secure API key.
Once the client ID and API key are available, make the API calls as follows:
https://{your_client_id}:{your_api_key}@{api_endpoint}/{api_version}/{resource}
Set up your Cisco AMP Connector
After completing the prerequisites, follow these steps to configure your Balbix connector for Cisco AMP.
Field Mapping
API Field Name | Balbix Field Name | Balbix Field |
connector_grid | Asset UUID | asset_uuid |
hostname | Asset Name | hostname |
operating_system | Operating System Name | os_name |
mac | Mac Address | mac |
ip | IP Address | ip |
application | Software Product Name | sw_product_name |
version | Software Product Version | sw_product_version |
cves > id | CVE ID | cve_id |
API reference documentation
For more information about the Cisco AMP API, see the following references: