What can you do with the Cisco Secure Endpoint integration?

LiveContext exposes 17 operations on Cisco Secure Endpoint, covering computer, group, isolation and policy. Common uses include finding the policy that a group should be bound to, tracing which machines a compromised account touched and checking whether a host can be isolated before trying.

LiveContext

All integrations

Cisco Secure Endpoint integration

Cisco Secure Endpoint, formerly AMP for Endpoints, management API: list and inspect protected computers, follow the event trajectory of a host, isolate a compromised endpoint from the network and release it again, search activity by observable such as a hash or address, read the security event feed, and manage groups and policies. Cisco runs one API host per region and the organization's data lives on exactly one of them, so the host is part of the credential. Requests authenticate with a third party API client identifier and an API key sent as HTTP basic credentials.

17 toolsBasic authAPI docs

Connect Cisco Secure Endpoint How integrations work

Common Cisco Secure Endpoint use cases

finding the policy that a group should be bound to
tracing which machines a compromised account touched
checking whether a host can be isolated before trying
creating a temporary quarantine group for an incident
finding hosts that have not checked in for a fortnight
releasing a host from containment once it has been cleaned
pulling new malware detection events into a triage workflow
auditing which exclusion sets and block lists a policy applies
cleaning up records for machines that have been decommissioned
confirming that an isolation request has actually taken effect

What you can do with Cisco Secure Endpoint

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Computer, 7 operations

DELETEdelete_computer
Deletes a Cisco Secure Endpoint computer record from the organization.
GETget_computer
Returns the full record of a single Cisco Secure Endpoint computer.
GETget_computer_trajectory
Returns the timeline of file, network and process events observed on a single host.
GETlist_computers
Returns the Cisco Secure Endpoint computers matching the given filters.
PATCHmove_computer_to_group
Reassigns a Cisco Secure Endpoint computer to another group, which is how its policy changes.
GETsearch_computer_activity
Returns the computers on which an observable such as a hash, file name, address or URL was seen.
GETsearch_user_activity
Returns the computers where activity by a named user account was recorded.

Group, 3 operations

POSTcreate_group
Creates a Cisco Secure Endpoint group that computers can then be moved into.
GETget_group
Returns a Cisco Secure Endpoint group including the policies bound to it and how many computers it holds.
GETlist_groups
Returns the Cisco Secure Endpoint groups, which are what policy is attached to.

Isolation, 3 operations

GETget_isolation
Reports whether a Cisco Secure Endpoint computer is isolated and whether isolation is available on it.
PUTstart_isolation
Cuts a Cisco Secure Endpoint computer off from the network while leaving the connector reachable.
DELETEstop_isolation
Restores network access to a Cisco Secure Endpoint computer that was isolated.

Policy, 2 operations

GETget_policy
Returns a Cisco Secure Endpoint policy with its file and address lists and the groups it is used in.
GETlist_policies
Returns the Cisco Secure Endpoint policies, optionally narrowed to one product platform.

Event, 1 operation

GETlist_events
Returns the Cisco Secure Endpoint security event feed filtered by type, host, group or file hash.

Event type, 1 operation

GETlist_event_types
Returns the full catalogue of Cisco Secure Endpoint event types with their numeric identifiers.

Use Cisco Secure Endpoint from Claude Code, Cursor or Codex

Connect Cisco Secure Endpoint in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Cisco Secure Endpoint operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Cisco Secure Endpoint

Create your workspace
Sign up free. Nothing to install.
Connect Cisco Secure Endpoint once
Add your Cisco Secure Endpoint connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Cisco Secure Endpoint integration FAQ

What can you do with the Cisco Secure Endpoint integration?: LiveContext exposes 17 operations on Cisco Secure Endpoint, covering computer, group, isolation and policy. Common uses include finding the policy that a group should be bound to, tracing which machines a compromised account touched and checking whether a host can be isolated before trying.