> For the complete documentation index, see [llms.txt](https://help.radiantsecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.radiantsecurity.ai/radiant-connectors/endpoint/cisco/cisco-orbital-query.md).

# Cisco Orbital Query

Cisco Orbital is a live osquery engine built into the Cisco Secure Endpoint agent that executes ad hoc SQL queries against endpoint processes, files, users, and network state in real time. Connecting Cisco Orbital Query gives Radiant Security on-demand query access to this endpoint state through the Secure Endpoint REST API. Radiant executes these queries during AI triage and investigation, giving analysts live host context to confirm the scope of suspicious activity.

{% hint style="info" %}
Cisco Orbital Query works alongside [Cisco Secure Endpoint Alerts](/radiant-connectors/endpoint/cisco/cisco-secure-endpoint.md). Secure Endpoint Alerts provides the alert stream Radiant triages; Orbital Query provides live endpoint telemetry when Radiant needs to confirm scope during investigation.
{% endhint %}

At the end of this configuration, you provide Radiant Security with the following values:

* **Client ID**
* **Client secret**
* **Cloud region** (North America or Europe)

### Prerequisites

* [ ] Admin access to Cisco Secure Endpoint or Cisco XDR
* [ ] Cisco Secure Endpoint agents deployed and reporting on the endpoints you want to query

### Create API credentials in Cisco Secure Endpoint

If you already created credentials for Cisco Secure Endpoint Alerts and included the **Orbital** scope, skip to Add the data connector in Radiant Security.

For vendor instructions, see [Secure Endpoint API authentication](https://developer.cisco.com/docs/secure-endpoint/authentication/) in the Cisco DevNet documentation.

1. Sign in to **Cisco Secure Endpoint** or **Cisco XDR** with an admin account.
2. Navigate to **Administration** > **API Clients**.
3. Click **Generate API Client**.
4. Enter a **Client Name** to identify the credential (e.g., `Radiant_Security_Orbital`).
5. Under **Scope**, select **Orbital**. To reuse this client for the [Cisco Secure Endpoint Alerts](https://help.radiantsecurity.ai/radiant-connectors/endpoint/cisco/cisco-secure-endpoint-alerts) feed, also select the scope that grants read access to alerts.
6. Optionally enter a **Description**, then click **Add New Client**.
7. Copy and store the **Client ID** and **Client Password** (client secret).

{% hint style="warning" %}
The client password is shown only once and cannot be recovered. If it is lost, you must generate a new API client.
{% endhint %}

### Add the data connector in Radiant Security

1. Sign in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, click **Settings** > **Data Connectors**, then click **+ Add Connector**.
3. Search for and select **Cisco Secure Endpoint REST API**, then click **Data Feeds**.
4. Under **Select your data feeds**, select **Cisco Orbital Query**, then click **Credentials**.
5. Under **Credential Name**, enter an identifiable name (e.g., `Cisco Secure Endpoint Credentials`). To reuse credentials created for Secure Endpoint Alerts, select them from the drop-down menu.
6. Under **Required Credentials**, enter the following:
   * **Cloud region**: Select **North America** or **Europe** to match your Secure Endpoint tenant.
   * **Client ID**: Paste the client ID from Cisco Secure Endpoint.
   * **Client secret**: Paste the client password from Cisco Secure Endpoint.
7. Click **Add Connector**.

### How Orbital Query collects data

Orbital Query does not continuously ingest logs. Radiant executes live osquery statements against targeted endpoints during investigation when additional endpoint context is needed. Queries target endpoints using node identifiers such as `amp:<connector_guid>`, where the connector GUID is the Secure Endpoint agent identifier for the host.

### Verify the connector

Because Orbital Query operates on demand, there is no continuous log stream to verify in Log Management. Confirm the connector is enabled and the credentials are valid:

1. In Radiant, navigate to **Settings** > **Data Connectors**.
2. Locate **Cisco Orbital Query** and confirm the connector status is healthy.

Once the status is healthy, Radiant can execute Orbital queries against the affected endpoint when it investigates a Cisco Secure Endpoint alert.

{% hint style="info" %}
If queries fail with an authentication error, confirm the API client includes the **Orbital** scope and that the **Cloud region** matches your tenant (North America or Europe).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.radiantsecurity.ai/radiant-connectors/endpoint/cisco/cisco-orbital-query.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.