Cisco Secure Endpoint

Connect Cisco Secure Endpoint to Radiant Security to forward endpoint alerts for AI triage.

Cisco Secure Endpoint (formerly Cisco AMP for Endpoints) is an endpoint detection and response platform that monitors files, processes, and network activity on managed hosts to surface malware, fileless attacks, and lateral movement. Connecting Cisco Secure Endpoint forwards alerts to Radiant Security through the Secure Endpoint REST API. Radiant uses these alerts for AI triage, giving analysts endpoint context to assess suspicious host activity without pivoting to the Cisco console.

At the end of this configuration, you provide Radiant Security with the following values:

• Client ID
• Client secret
• Cloud region (North America or Europe)

Prerequisites

• Admin access to Cisco Secure Endpoint or Cisco XDR
• Cisco Secure Endpoint agents deployed on the endpoints you want to monitor

Create API credentials in Cisco Secure Endpoint

For vendor instructions, see Secure Endpoint API authentication in the Cisco DevNet documentation.

1. Sign in to Cisco Secure Endpoint or Cisco XDR with an admin account.
2. Navigate to Administration > API Clients.
3. Click Generate API Client.
4. Enter a Client Name to identify the credential (e.g., Radiant_Security_Secure_Endpoint).
5. Under Scope, select at least one Secure Endpoint scope that grants read access to alerts and events.
6. Optionally enter a Description, then click Add New Client.
7. Copy and store the Client ID and Client Password (client secret).

The client password is shown only once and cannot be recovered. If it is lost, you must generate a new API client.

If you also plan to enable Cisco Orbital Query for live endpoint queries during investigation, include the Orbital scope when creating this API client. Both feeds use the same credential.

Add the data connector in Radiant Security

1. Sign in to Radiant Security.
2. From the navigation menu, click Settings > Data Connectors, then click + Add Connector.
3. Search for and select Cisco Secure Endpoint REST API, then click Data Feeds.
4. Under Select your data feeds, select Cisco Secure Endpoint Alerts, then click Credentials.
5. Under Credential Name, enter an identifiable name (e.g., Cisco Secure Endpoint Credentials). To reuse existing credentials, select them from the drop-down menu.
6. Under Required Credentials, enter the following:

   • Client ID: Paste the client ID from Cisco Secure Endpoint.
   • Client secret: Paste the client password from Cisco Secure Endpoint.
   • Cloud region: Select North America or Europe to match your Secure Endpoint tenant.
7. Click Add Connector.

Verify ingestion

After Cisco Secure Endpoint begins forwarding, confirm alerts are reaching Radiant.

1. In Radiant, navigate to Log Management.
2. Filter by rs_connectorType:"cisco_secure_endpoint_alerts".
3. Confirm recent alerts appear.

Allow several minutes for alerts to be parsed, indexed, and available for search.