Cisco AMP for Endpoints API

GET /v1/groups

Description

Provides basic information about groups in your organization. This endpoint is provided so that you can map group names to guids for filtering on the events endpoint.

Query Parameters

Name Type Example Values Description
name String Audit
limit Integer 5

Show Response Fields

Name Type Description
version String
metadata.links.self String
metadata.results.total Integer
metadata.results.current_item_count Integer
metadata.results.index Integer
metadata.results.items_per_page Integer
data Array
data[].name String
data[].description String
data[].guid GUID
data[].source String
data[].links.group String
Write
Preview
Auto Generate

Examples

Fetch list of groups filtered by name
Fetch list of groups

Fetch list of groups filtered by name

Request

Requires Authorization 
GET /v1/groups?name=Audit&limit=5
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/groups?name=Audit&limit=5'

Response

Shortened for readability 

strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 2455
x-ratelimit-remaining: 2722
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2018-09-17T21:58:25Z
transfer-encoding: chunked

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/groups?name=Audit&limit=5"
    },
    "results": {
      "total": 1,
      "current_item_count": 1,
      "index": 0,
      "items_per_page": 5
    }
  },
  "data": [
    {
      "name": "Audit",
      "description": "Audit Group for FireAMP API Docs",
      "guid": "b077d6bc-bbdf-42f7-8838-a06053fbd98a",
      "source": null,
      "links": {
        "group": "https://api.amp.cisco.com/v1/groups/b077d6bc-bbdf-42f7-8838-a06053fbd98a"
      }
    }
  ]
}

Fetch list of groups

Request

Requires Authorization 
GET /v1/groups
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.amp.cisco.com/v1/groups'

Response

Shortened for readability 

strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 2182
x-ratelimit-remaining: 2575
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2018-10-03T17:33:35Z
transfer-encoding: chunked

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.amp.cisco.com/v1/groups"
    },
    "results": {
      "total": 27,
      "current_item_count": 27,
      "index": 0,
      "items_per_page": 500
    }
  },
  "data": [
    {
      "name": "afcILiVA",
      "description": "This is a new group",
      "guid": "67b5e432-1d8c-4a1c-9208-17d2c797e318",
      "source": "Created via API",
      "links": {
        "group": "https://api.amp.cisco.com/v1/groups/67b5e432-1d8c-4a1c-9208-17d2c797e318"
      }
    },
    {
      "name": "AfdYnoIi",
      "description": "This is a new group",
      "guid": "4060cf94-26e5-4176-8dea-cd3d0b68d8bc",
      "source": "Created via API",
      "links": {
        "group": "https://api.amp.cisco.com/v1/groups/4060cf94-26e5-4176-8dea-cd3d0b68d8bc"
      }
    }
  ]
}