Which platform has an API that be used to obtain a list of vulnerable software on user devices?

Cisco Advanced Malware Protection (AMP) for Endpoints, now known as Cisco Secure Endpoint, is an agent-based security solution installed directly on user devices. A core capability of this platform is to create a detailed inventory of all software on an endpoint. It then correlates this software list against a comprehensive database of known Common Vulnerabilities and Exposures (CVEs). The platform provides a robust REST API that allows administrators and security automation tools to programmatically query for specific devices and retrieve a list of all identified vulnerable software, making it the correct platform for this task.

A. Cisco Umbrella: This is a cloud-delivered security service focusing on DNS-layer security, secure web gateway, and CASB functions; it does not perform on-device software vulnerability scanning.
B. Cisco Firepower: This is a network security appliance (NGFW/IPS) that inspects network traffic; it lacks the direct endpoint agent required for a comprehensive software inventory and vulnerability assessment.
C. Cisco Identity Services Engine: This is a network access control (NAC) solution that performs endpoint posture checks for policy compliance (e.g., OS patch level), not a full vulnerability scan of all installed software.

1. Cisco Secure Endpoint (formerly AMP for Endpoints) API v1 Documentation: The official API documentation explicitly details the "Vulnerabilities" endpoint. The description for the GET /v1/computers/{connectorguid}/vulnerabilities call states it will "Return all vulnerabilities for a connector." This directly confirms the ability to obtain a list of vulnerable software via an API.

Source: Cisco DevNet, Secure Endpoint API documentation. (developer.cisco.com/docs/amp-for-endpoints/#!vulnerabilities)

2. Cisco Secure Endpoint Data Sheet: This official product document outlines the platform's features. Under the "Vulnerability Assessment" section, it states, "Pinpoint vulnerabilities with a built-in view of software inventory and vulnerabilities per endpoint." This confirms the feature is integral to the product.

Source: Cisco Secure Endpoint At-a-Glance, Page 2, "Vulnerability Assessment" section.

3. Cisco Live Presentation BRKSEC-2043: In presentations covering Cisco Secure Endpoint, the architecture is described as having an endpoint agent (connector) that reports software inventory and other telemetry to the cloud console. The console's vulnerability analysis capabilities and the availability of this data through the API are common topics.

Source: Cisco Live On-Demand Library, "An Insider's Guide to Cisco Secure Endpoint" (BRKSEC-2043), Section on Endpoint Telemetry and Vulnerability Management.