Integration

Cisco Secure Endpoint integration

Cisco Secure Endpoint, formerly AMP for Endpoints, management API: list and inspect protected computers, follow the event trajectory of a host, isolate a compromised endpoint from the network and release it again, search activity by observable such as a hash or address, read the security event feed, and manage groups and policies. Cisco runs one API host per region and the organization's data lives on exactly one of them, so the host is part of the credential. Requests authenticate with a third party API client identifier and an API key sent as HTTP basic credentials.

Connect Cisco Secure Endpoint How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Cisco Secure Endpoint.Built from the 17 Cisco Secure Endpoint tools below, on the connection you add once.

Common Cisco Secure Endpoint use cases

finding the policy that a group should be bound to
tracing which machines a compromised account touched
checking whether a host can be isolated before trying
creating a temporary quarantine group for an incident
finding hosts that have not checked in for a fortnight
releasing a host from containment once it has been cleaned
pulling new malware detection events into a triage workflow
auditing which exclusion sets and block lists a policy applies
cleaning up records for machines that have been decommissioned
confirming that an isolation request has actually taken effect

What you can do with Cisco Secure Endpoint

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Computer, 7 operations

delete_computerDelete computerDELETEDeletes a Cisco Secure Endpoint computer record from the organization.
get_computerGet computerGETReturns the full record of a single Cisco Secure Endpoint computer.
get_computer_trajectoryGet computer trajectoryGETReturns the timeline of file, network and process events observed on a single host.
list_computersList computersGETReturns the Cisco Secure Endpoint computers matching the given filters.
move_computer_to_groupMove computer to groupPATCHReassigns a Cisco Secure Endpoint computer to another group, which is how its policy changes.
search_computer_activitySearch computer activityGETReturns the computers on which an observable such as a hash, file name, address or URL was seen.
search_user_activitySearch user activityGETReturns the computers where activity by a named user account was recorded.

Group, 3 operations

create_groupCreate groupPOSTCreates a Cisco Secure Endpoint group that computers can then be moved into.
get_groupGet groupGETReturns a Cisco Secure Endpoint group including the policies bound to it and how many computers it holds.
list_groupsList groupsGETReturns the Cisco Secure Endpoint groups, which are what policy is attached to.

Isolation, 3 operations

get_isolationGet isolationGETReports whether a Cisco Secure Endpoint computer is isolated and whether isolation is available on it.
start_isolationStart isolationPUTCuts a Cisco Secure Endpoint computer off from the network while leaving the connector reachable.
stop_isolationStop isolationDELETERestores network access to a Cisco Secure Endpoint computer that was isolated.

Policy, 2 operations

get_policyGet policyGETReturns a Cisco Secure Endpoint policy with its file and address lists and the groups it is used in.
list_policiesList policiesGETReturns the Cisco Secure Endpoint policies, optionally narrowed to one product platform.

Event, 1 operation

list_eventsList eventsGETReturns the Cisco Secure Endpoint security event feed filtered by type, host, group or file hash.

Event type, 1 operation

list_event_typesList event typesGETReturns the full catalogue of Cisco Secure Endpoint event types with their numeric identifiers.

Use Cisco Secure Endpoint from Claude Code, Cursor or Codex

Connect Cisco Secure Endpoint in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Cisco Secure Endpoint operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Cisco Secure Endpoint

Create your workspace
Sign up free. Nothing to install.
Connect Cisco Secure Endpoint once
Add your Cisco Secure Endpoint connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Cisco Secure Endpoint integration FAQ

What can you do with the Cisco Secure Endpoint integration?

LiveContext exposes 17 operations on Cisco Secure Endpoint, covering computer, group, isolation and policy. Common uses include finding the policy that a group should be bound to, tracing which machines a compromised account touched and checking whether a host can be isolated before trying.