Get computer
ReadRead one computer.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
Security & Identity · CONNECTIONCisco Secure Endpoint + NodeHub
Read Secure Endpoint computers, trajectory, activity searches, events and groups, and isolate a computer or end its isolation.
Explore 11 workflow actions for Cisco Secure Endpoint, including account permissions and operation limits.
9 read actions2 write actions
WORKFLOW ACTIONS
What you can configure.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Get computer trajectory
ReadRead a computer's file and network activity, optionally matching a SHA-256, file name, user name or IP.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
Get group
ReadRead one group and its policies.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
Get isolation status
ReadRead whether a computer can be isolated and its isolation status.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
Isolate computer
WriteIsolate a computer from the network. Cisco answers 409 when it is already isolated.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
A repeated request may repeat the external action. Review the previous result before retrying a write.
List computers
ReadList computers with the connector installed, optionally by hostname, IP, group or last seen.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
List events
ReadList detection and activity events, optionally for one computer, group, event type or SHA-256.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
List groups
ReadList groups, optionally by name.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
Search computer activity
ReadFind computers that saw an IPv4 address, SHA-256, file name or URL fragment.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
Search user activity
ReadFind computers with activity by a user name.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
Stop isolation
WriteEnd a computer's isolation. Cisco answers 409 when it is not isolated.
Permissions and limits
Account permissions
- A Secure Endpoint API client ID and key (read and write scope for isolation)
A repeated request may repeat the external action. Review the previous result before retrying a write.
SETUP
Start with a controlled test.
01Connect the intended account
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
02Review inputs and access
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
03Confirm the result
Inspect step outputs and confirm the result in Cisco Secure Endpoint. A saved workflow is not a completed provider action.
EXPLORE YOUR STACK
