Cisco Secure Endpoint Out-of-the-Box Response Integration
Requirements
- A Cisco Secure Endpoint Essentials or above subscription
- An active Lumu Defender subscription
Create API key
1. Log in on the Cisco Secure Endpoint Portal. Click on the Administration option on the left navigation bar, then click on the API Credentials option.
2. Within the API Credentials window, click on New API Credential.
3. In the New API Credential window, in the Scope field, choose Read & Write and click on Create.
4. After generating the API Credentials a dialog box will appear displaying the Client ID, and API Key. Store these values, they will be needed later.
Once you close this window, you won't be able to retrieve the API Key again.
Create lists for Lumu integration
1. Navigate to Outbreak Control. There you will see all the available options to configure. We will focus on Custom Detections > Simple and Application Control > Blocked Applications.
2. Custom Detections - Simple functions similarly to a blocklist. These are files you want to detect and quarantine. An entry in a Simple Custom Detection list will not only quarantine future occurrences of the file but, through Retrospective, will also quarantine instances of the file on any endpoints where the service has already encountered it. Choose a name that best suits the integration with Lumu, such as Lumu Detections - Simple List.
3. Application control - Blocked applications are files you do not want to allow users to execute but do not want to quarantine. Use this for files you are not sure are malware, unauthorized applications, or to stop applications with vulnerabilities from executing until a patch has been released. Choose a name that best suits the integration with Lumu, such as Lumu Detections - Blocked List.
These lists are subject to caching as specified under the Cache tab in your Policies. The default length of time a file is cached depends on its disposition, as follows:
- Clean files: 7 days
- Unknown files: 1 hour
- Malicious files: 1 hour
If a file is added to a Simple Custom Detection list, the cache time must expire before the detection will take effect.
Add Integration
Log into your Lumu account through the Lumu Portal Client or theLumu MSP Portaland navigate to the integrations screen.
1. Go to the Response integrations tab
2. Locate the Cisco Secure Endpoint integration
3. Familiarize yourself with the integration details and click the Activate button to start the integration set up.
4. To enable the integration, press the Activate button. After reviewing the instructions, enter a descriptive name and choose the Threat Types you want to send to Cisco Secure Endpoint.
5. Choose the Base URL that matches your server. Enter the necessary details, including the Client ID and API Key, which were obtained earlier in this guide, and click the Activate button. Lumu will verify the accuracy of the credentials provided.
6. Choose the Simple Custom Detection List and Application Block List created in the previous steps.
7. The integration is now created and active. Now, the Lumu Portal will display the details of the created integration:
After the integration is activated, the selected Simple Custom Selection List and Application Block List will be updated with confirmed compromises detected by Lumu within the past 3 days.
Related Articles
Sophos Endpoint Protection Out-of-the-Box Response Integration
To learn more about Out-of-the-box Integrations and their benefits, please refer to this article. Requirements Sophos Central Sophos Central Account Access. API Token. You can obtain it in the API Token Management console. Lumu License An active Lumu ...Harmony Endpoint Out-of-the-Box Response Integration
Requirements An active Harmony Endpoint Basic or above subscription An account with administrative privileges that allows you to access the Infinity Portal and manage API keys for the Endpoint service. An active Lumu Defender subscription Create API ...Cisco Umbrella Out-of-the-box Response Integration
To learn more about Out-of-the-box Integrations and their benefits, please refer to this article. Requirements A Cisco Umbrella DNS Security Essentials subscription package or above Lumu Defender Subscription Setup Cisco Umbrella Rest API Client To ...Cisco Meraki Out-of-the-Box Response Integration
Requirements Cisco Meraki A Cisco deployment with MX devices is needed to work with Firewall rules. To get more information about licensing options, you can consult the documentation on Meraki MX Security and SD-WAN Licensing. An active Lumu Defender ...Cisco Firepower Out-of-the-box Response Integration
To learn more about Out-of-the-box Integrations and their benefits, please refer to this article. In this article, you will find out how to configure Cisco Firepower to receive and block adversaries detected by Lumu and improve the detection & ...