Cisco Orbital Query

Connect Cisco Orbital Query to Radiant Security for on-demand endpoint queries during AI triage and investigation.

Cisco Orbital is a live osquery engine built into the Cisco Secure Endpoint agent that executes ad hoc SQL queries against endpoint processes, files, users, and network state in real time. Connecting Cisco Orbital Query gives Radiant Security on-demand query access to this endpoint state through the Secure Endpoint REST API. Radiant executes these queries during AI triage and investigation, giving analysts live host context to confirm the scope of suspicious activity.

Cisco Orbital Query works alongside Cisco Secure Endpoint Alerts. Secure Endpoint Alerts provides the alert stream Radiant triages; Orbital Query provides live endpoint telemetry when Radiant needs to confirm scope during investigation.

At the end of this configuration, you provide Radiant Security with the following values:

• Client ID
• Client secret
• Cloud region (North America or Europe)

Prerequisites

• Admin access to Cisco Secure Endpoint or Cisco XDR
• Cisco Secure Endpoint agents deployed and reporting on the endpoints you want to query

Create API credentials in Cisco Secure Endpoint

If you already created credentials for Cisco Secure Endpoint Alerts and included the Orbital scope, skip to Add the data connector in Radiant Security.

For vendor instructions, see Secure Endpoint API authentication in the Cisco DevNet documentation.

1. Sign in to Cisco Secure Endpoint or Cisco XDR with an admin account.
2. Navigate to Administration > API Clients.
3. Click Generate API Client.
4. Enter a Client Name to identify the credential (e.g., Radiant_Security_Orbital).
5. Under Scope, select Orbital. To reuse this client for the Cisco Secure Endpoint Alerts feed, also select the scope that grants read access to alerts.
6. Optionally enter a Description, then click Add New Client.
7. Copy and store the Client ID and Client Password (client secret).

The client password is shown only once and cannot be recovered. If it is lost, you must generate a new API client.

Add the data connector in Radiant Security

1. Sign in to Radiant Security.
2. From the navigation menu, click Settings > Data Connectors, then click + Add Connector.
3. Search for and select Cisco Secure Endpoint REST API, then click Data Feeds.
4. Under Select your data feeds, select Cisco Orbital Query, then click Credentials.
5. Under Credential Name, enter an identifiable name (e.g., Cisco Secure Endpoint Credentials). To reuse credentials created for Secure Endpoint Alerts, select them from the drop-down menu.
6. Under Required Credentials, enter the following:

   • Cloud region: Select North America or Europe to match your Secure Endpoint tenant.
   • Client ID: Paste the client ID from Cisco Secure Endpoint.
   • Client secret: Paste the client password from Cisco Secure Endpoint.
7. Click Add Connector.

How Orbital Query collects data

Orbital Query does not continuously ingest logs. Radiant executes live osquery statements against targeted endpoints during investigation when additional endpoint context is needed. Queries target endpoints using node identifiers such as amp:<connector_guid>, where the connector GUID is the Secure Endpoint agent identifier for the host.

Verify the connector

Because Orbital Query operates on demand, there is no continuous log stream to verify in Log Management. Confirm the connector is enabled and the credentials are valid:

1. In Radiant, navigate to Settings > Data Connectors.
2. Locate Cisco Orbital Query and confirm the connector status is healthy.

Once the status is healthy, Radiant can execute Orbital queries against the affected endpoint when it investigates a Cisco Secure Endpoint alert.

If queries fail with an authentication error, confirm the API client includes the Orbital scope and that the Cloud region matches your tenant (North America or Europe).