Help Documentation

Managed Detection and Response

Cisco Secure Endpoint Monitoring

Updated Sep 6, 2023

Configure Cisco Secure Endpoint monitoring

You can configure Cisco Secure Endpoint® to send the necessary logs to Arctic Wolf® for security monitoring.

Requirements

Steps

  1. Create API client credentials.
  2. Provide credentials to Arctic Wolf.

Step 1: Create API client credentials

  1. Sign in to the Cisco Secure Endpoint console as an administrator.

  2. In the navigation menu, click Admin > API Credentials.

  3. On the API Credentials page, click New API Credential.

  4. In the New API Credential dialog:

    1. In the Application name field, enter a memorable name for the credentials.
    2. Under Scope, select Read-only.
    3. Select the Enable Command line checkbox.
    4. Select the Allow API access to File Repository download audit logs checkbox.
    5. Click Create.

  5. On the API Key Details page, record the newly generated Client ID and API Key values.

    You must submit these values to Arctic Wolf.

    Note: Once you dismiss this page, you can no longer retrieve the API Key from the console.

Step 2: Provide credentials to Arctic Wolf

Note: If API credentials fail, for example, due to expired credentials, Arctic Wolf will notify you and request a new set of credentials. After receiving refreshed credentials, Arctic Wolf can only retrieve data from the previous 12 hours. Provide refreshed credentials within 12 hours of expiry to ensure complete data polling and coverage. See MDR polling frequency for more information.

  1. Sign in to the Arctic Wolf Unified Portal.

  2. In the menu bar, click Telemetry Management > Connected Accounts.

  3. Click Add Account +.

  4. On the Add Account page, from the Account Type list, select Cloud Detection and Response.

  5. From the list of cloud services, select Cisco Secure Endpoint.

  6. On the Add Account page, do the following steps:

    1. Account Name — Enter a unique and descriptive name for the account.

    2. For each of these fields, paste the appropriate value from Create API client credentials:

      • Client ID
      • API Key

    3. In the API Base URL, select the appropriate region base URL.

    4. Credential Expiry — (Optional) Enter the expiration date if the credentials have an expiry date.

  7. Click Test and Submit Credentials.

    After your Concierge Security® Team (CST) enables security monitoring for this account, the connected account status changes to Healthy.

MDR polling frequency

Arctic Wolf® Managed Detection and Response (MDR) polls third-party API integrations at regular intervals. Time-based events are polled with a delay to make sure data is available within the third-party API endpoint. For new deployments, after the API integration is successfully configured with the necessary credentials, Arctic Wolf begins polling and reviewing activity from approximately 1 hour prior to configuration success.