amphunt - Cisco Secure Endpoint Threat Hunting Skills for Claude

You can automate threat hunting across Cisco Secure Endpoint by orchestrating AMP API queries through script-based automation to retrieve timelines, correlate events, and surface actionable alerts without manual API calls.

Yes, you can extract a full timeline of endpoint events from the AMP API by routing queries through dedicated timeliner scripts that pull and correlate chronological activity for rapid triage.

To trace network connections associated with a malicious hash, you run hash2connection scripts that correlate the specific hash against endpoint network activity to identify related connections.

Yes, this threat hunting approach handles API rate limiting and credential security by implementing robust error handling and secure credential use within the AMP API client during automated queries.

You can run full-environment triage, endpoint deep-dives, hash-based hunts, network analysis, and persistence or vulnerability investigations against Cisco AMP endpoints using centralized threat-hunting scripts.

Yes, you can search for multiple keywords or IOCs across multiple endpoints simultaneously by executing multikeyword search scripts that query the AMP API to surface correlated matches.