Configuring Notifications with Cisco AMP

So I am often asked this question, so I figured I would blog it & then be able to just send a link to the blog to the next person(s) who ask this question. The magic question I’m referring to is: “how do I configure an email notification for events in AMP“.

I guess I can see why this question is so common, as the method for which one would accomplish this task is a little different than other products, but once you use it I think you’ll find it to be very easy.

Instead of forcing an admin to configure alerts on a per-event basis, like many products out there will do, AMP makes things a little bit easier on you. AMP has you create a filter of the events you want to alert on, and then you “subscribe” to that filter. This way you can have multiple events in a single filter, if you choose to. You can also configure your filter to only apply to certain device groups, and therefore make the email alerts even more relevant to you.

In addition, the filters and subscriptions may be applied per administrative user. Meaning if Bob & Sally are both AMP admins, they can each have their own set of filters that they subscribe to.

Configuring the notification

Starting off in your AMP dashboard (https://console.amp.cisco.com) you might want to click on the compromised event in the bottom of the dashboard or on the events tab (as pointed out in Figure 1).

Figure 1 - Dashboard
Figure 1 – AMP console dashboard

The next step in your evolution to create these notifications is to create a filter in the events window. This is where some things change from the normal paradigm you may be used to.

Here you create filters of the events, and it is the filters that you are actually subscribing to, not the individual events. In many ways, this is much easier than the traditional methods where an interested party subscribes to each and every event individually. In this model, you are able to subscribing to a grouping of events that match your specific filter/query.

As you see in Figure 2, the UI can be a bit confusing for those who are new to it. You start by creating the filter, and in the lower right-hand side of the filter – it provides the ability to click the “Not Subscribed” button & subscribe to the filter.

Figure 2 - Create Filter in Events
Figure 2 – Creating an event filter

When you subscribe to the filter, you are provided with the choices shown in Figure 3. You can be immediately notified with an email that contains all the events that occurred within the filter; or notified immediately with a single email for each event in the filter. Instead of immediate notification, you can have a periodic email sent out hourly, daily, weekly or monthly.

Figure 3 - Configuring Notiifcation for Filter
Figure 3 – Subscription options

You must save the filter, which will prompt you to provide a name for the saved filter, as seen in Figure 4.

Figure 4 - Name the new Filter
Figure 4 – Saving and naming the filter

The notifications are created on a per-user basis, and they will be sent to the notification email address configured within the AMP administrative users’ account, as seen in Figure 5. If an entire team or distribution list should receive the notifications, simply change the Notification Email in the user account to be that of the distribution list. You will also see the list of subscriptions is displayed at the bottom of the user account page.

Figure 5 - Account Settings -Subscriptions and Notification Email
Figure 5 – Notification email setting of an AMP login account

If you read this blog entry, chances are that you asked me or a member of my team how to create notifications for events in the AMP console, and I hope this helped you.

-Aaron

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.