Cisco Security

Use Cisco Security data for Cortex AgentiX.

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

Cisco security products for endpoint malware protection (AMP/Secure Endpoint), email and web security (ESA, SMA, WSA), network and cloud analytics (Secure Network Analytics/Stealthwatch, Secure Cloud Analytics), malware analysis and threat intelligence (Secure Malware Analytics/Threat Grid, Webex Feed), collaboration (Webex Teams), cloud security (CloudLock), vulnerability management (Kenna), and phishing lookup (PhishTank) across the Cisco portfolio. Use these connectors to fetch events and issues, enrich indicators, and run automation and remediation.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• AMP: Uses CISCO AMP Endpoint. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AMPv2: Cisco Advanced Malware Protection software is designed to prevent, detect, and help remove threats in an efficient manner from computer systems. Threats can take the form of software viruses and other malware such as ransomware, worms, Trojans, spyware, adware, and fileless malware. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• Cisco CloudLock: Query Cisco CloudLock. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• Cisco Secure Malware Analytics: This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• Cisco Spark: Send messages, create rooms and more, via the Cisco Spark API. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• Cisco Stealthwatch: Scalable visibility and security analytics. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• Cisco WebEx Feed: Use the Cisco Webex Feed integration to fetch indicators from Webex. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• CiscoESA: This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• CiscoSMA: The Security Management Appliance (SMA) is used to centralize services from Email Security Appliances (ESAs) and Web Security Appliances (WSAs). This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• CiscoThousandEyes: This is the Cisco ThousandEyes event collector integration for Cortex XSIAM. This connector is available with any active Cortex XSIAM license.
• CiscoWSAv2: Cisco Secure Web Appliance protects your organization by automatically blocking risky sites and testing unknown sites before allowing users to click on them. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• Kennav2: Use the Kenna v2 integration to search and update vulnerabilities, schedule a run connector, and manage tags and attributes. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• PhishTank V2: PhishTank is a free community site where anyone can submit, verify, track, and share phishing data. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• Stealthwatch Cloud: Protect your cloud assets and private network. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• ThreatGridv2: Query and upload samples to Cisco threat grid. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.

To configure this connector, follow the steps outlined in the configuration wizard.