Cisco AMP for Endpoints API

GET /v1/groups

Description

Provides basic information about groups in your organization. This endpoint is provided so that you can map group names to guids for filtering on the events endpoint.

Query Parameters

Name Type Example Values Description
name String Audit
limit Integer 5

Show Response Fields

Name Type Description
version String
metadata.links.self String
metadata.results.total Integer
metadata.results.current_item_count Integer
metadata.results.index Integer
metadata.results.items_per_page Integer
data Array
data[].name String
data[].description String
data[].guid GUID
data[].source String
data[].links.group String
Write
Preview
Auto Generate

Examples

Fetch list of groups
Fetch list of groups filtered by name

Fetch list of groups

Request

Requires Authorization 
GET /v1/groups
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/groups'

Response

Shortened for readability 

content-type: application/json; charset=utf-8
transfer-encoding: chunked
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 1962
referrer-policy: strict-origin-when-cross-origin
x-ratelimit-remaining: 2801
x-permitted-cross-domain-policies: none
x-download-options: noopen
etag: W/"a329dada675d56007239ce87d5bb109f"
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2021-05-05T23:55:49Z
strict-transport-security: max-age=31536000

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/groups"
    },
    "results": {
      "total": 111,
      "current_item_count": 111,
      "index": 0,
      "items_per_page": 500
    }
  },
  "data": [
    {
      "name": "00-mar25-forensic-group",
      "description": "",
      "guid": "a4a983ef-91df-428f-9b08-1e88ec5357df",
      "source": null,
      "links": {
        "group": "https://api.amp.cisco.com/v1/groups/a4a983ef-91df-428f-9b08-1e88ec5357df"
      }
    },
    {
      "name": "abBUcAHE",
      "description": "This is a new group",
      "guid": "5cdf70dd-1b14-46a0-be90-e08da14172d8",
      "source": "Created via API",
      "links": {
        "group": "https://api.amp.cisco.com/v1/groups/5cdf70dd-1b14-46a0-be90-e08da14172d8"
      }
    }
  ]
}

Fetch list of groups filtered by name

Request

Requires Authorization 
GET /v1/groups?name=Audit&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/groups?name=Audit&limit=5'

Response

Shortened for readability 

content-type: application/json; charset=utf-8
transfer-encoding: chunked
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 1962
referrer-policy: strict-origin-when-cross-origin
x-ratelimit-remaining: 2800
x-permitted-cross-domain-policies: none
x-download-options: noopen
etag: W/"5f2b7688e135c402e41b710c00e1f222"
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2021-05-05T23:55:49Z
strict-transport-security: max-age=31536000

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/groups?name=Audit&limit=5"
    },
    "results": {
      "total": 1,
      "current_item_count": 1,
      "index": 0,
      "items_per_page": 5
    }
  },
  "data": [
    {
      "name": "Audit",
      "description": "Audit Group for FireAMP API Docs",
      "guid": "b077d6bc-bbdf-42f7-8838-a06053fbd98a",
      "source": null,
      "links": {
        "group": "https://api.amp.cisco.com/v1/groups/b077d6bc-bbdf-42f7-8838-a06053fbd98a"
      }
    }
  ]
}