If you're having trouble at any stage please contact us at support@skyformation.com. 

Preface

The goal of this guide is to add a new SkyFormation for Cisco AMP for endpoints Connector to your SkyFormation Platform.

Prerequisites

To add theCisco AMP for endpoints connector to SkyFormation app, you will need to have the following information at hand:

1. Client ID
   
   
2. Client Key
   
   In order to get this information follow the next steps:
   1. log into https://console.amp.cisco.com
   2. Go to the API Credentials from the Accounts dropdown menu.
      
      
   3. Click on the  button.
      
      
   4. Fill in an application name of your choice, and select "read only" permissions.
   5. You will be presented with two values:3rd Party API Client ID and API Key
   6. Keep the 2 values as they will be required in the next step.

On-board SkyFormation for Cisco AMP for endpoints connector - steps

1. Logon to your SkyFormation Platform:

2. Navigate via left navigation panel to "Settings" section

3. Navigate via New Settings left navigation panel to "Accounts" section

4. Click the "Add Account" bottom

5. At the "SELECT SERVICE TO ADD" choose "Cisco Amp" 

    You will see the below screen:

6. Fill in the following information:

    - Account Name
        Give the Cisco AMP account a meaningful name for you. This will become your cloud app 
        connector name displayed in the application and the events sent to external 
        systems as SIEM/Log management. This is a mandatory field.

      e.g. "Corporate AMP for endpoints"     

    - Description
      Add a text that describes the Cisco AMP service account for you.

      e.g. "An admin service to manage the Corp AMP suite". This is an optional field.

   -  Client ID

        The client ID from the prerequisites section.

   - Client Key 

        The secure API Key. from the prerequisites section. 

 - Region

       US/EU according to the amp server you are using. If you      are using https://console.amp.cisco.com this is the US region. If you are using https://console.eu.amp.cisco.com this is the EU region. 

At this point you can click on "TEST CONNECTION" to make sure the connection is setup successfully, or just click on "DONE".

Start the Cisco AMP connector and make sure that the status becomes "OK" after a few seconds.

DONE!