> For the complete documentation index, see [llms.txt](https://help.radiantsecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.radiantsecurity.ai/radiant-connectors/endpoint/cisco/cisco-secure-endpoint.md).

# Cisco Secure Endpoint

Cisco Secure Endpoint (formerly Cisco AMP for Endpoints) is an endpoint detection and response platform that monitors files, processes, and network activity on managed hosts to surface malware, fileless attacks, and lateral movement. Connecting Cisco Secure Endpoint forwards alerts to Radiant Security through the Secure Endpoint REST API. Radiant uses these alerts for AI triage, giving analysts endpoint context to assess suspicious host activity without pivoting to the Cisco console.

At the end of this configuration, you provide Radiant Security with the following values:

* **Client ID**
* **Client secret**
* **Cloud region** (North America or Europe)

### Prerequisites

* [ ] Admin access to Cisco Secure Endpoint or Cisco XDR
* [ ] Cisco Secure Endpoint agents deployed on the endpoints you want to monitor

### Create API credentials in Cisco Secure Endpoint

For vendor instructions, see [Secure Endpoint API authentication](https://developer.cisco.com/docs/secure-endpoint/authentication/) in the Cisco DevNet documentation.

1. Sign in to **Cisco Secure Endpoint** or **Cisco XDR** with an admin account.
2. Navigate to **Administration** > **API Clients**.
3. Click **Generate API Client**.
4. Enter a **Client Name** to identify the credential (e.g., `Radiant_Security_Secure_Endpoint`).
5. Under **Scope**, select at least one Secure Endpoint scope that grants read access to alerts and events. 
6. Optionally enter a **Description**, then click **Add New Client**.
7. Copy and store the **Client ID** and **Client Password** (client secret).

{% hint style="warning" %}
The client password is shown only once and cannot be recovered. If it is lost, you must generate a new API client.
{% endhint %}

{% hint style="info" %}
If you also plan to enable [Cisco Orbital Query](/radiant-connectors/endpoint/cisco/cisco-orbital-query.md) for live endpoint queries during investigation, include the **Orbital** scope when creating this API client. Both feeds use the same credential.
{% endhint %}

### Add the data connector in Radiant Security

1. Sign in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, click **Settings** > **Data Connectors**, then click **+ Add Connector**.
3. Search for and select **Cisco Secure Endpoint REST API**, then click **Data Feeds**.
4. Under **Select your data feeds**, select **Cisco Secure Endpoint Alerts**, then click **Credentials**.
5. Under **Credential Name**, enter an identifiable name (e.g., `Cisco Secure Endpoint Credentials`). To reuse existing credentials, select them from the drop-down menu.
6. Under **Required Credentials**, enter the following:
   * **Client ID**: Paste the client ID from Cisco Secure Endpoint.
   * **Client secret**: Paste the client password from Cisco Secure Endpoint.
   * **Cloud region**: Select **North America** or **Europe** to match your Secure Endpoint tenant.
7. Click **Add Connector**.

### Verify ingestion

After Cisco Secure Endpoint begins forwarding, confirm alerts are reaching Radiant.

1. In Radiant, navigate to [Log Management](https://app.radiantsecurity.ai/logs).
2. Filter by `rs_connectorType:"cisco_secure_endpoint_alerts"`.
3. Confirm recent alerts appear.

{% hint style="info" %}
Allow several minutes for alerts to be parsed, indexed, and available for search.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.radiantsecurity.ai/radiant-connectors/endpoint/cisco/cisco-secure-endpoint.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.