Cisco Firepower v3.0.2

About the connector

Cisco Firepower is your administrative nerve center for managing critical Cisco network security solutions. It provides a complete and unified management of firewalls, application control, intrusion prevention, URL filtering, and advanced malware protection.

This document provides information about the Cisco Firepower connector, which facilitates automated interactions with Cisco Firepower using FortiSOAR™ playbooks. Add the Cisco Firepower connector as a step in FortiSOAR™ playbooks and perform automated operations, such as retrieving a list currently blocked networks on a Firepower Network Group Object and blocking or unblocking an IP address on a Firepower Network Group Object.

Version information

Connector Version: 3.0.2

Authored By: Fortinet

Certified: No

Release Notes for version 3.0.2

Following enhancements have been made to the Cisco Firepower Connector in version 3.0.2:

• Fixed an issue where the actions Block IP and Unblock IP were failing with the following error:

  Failed to parse

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-cisco-firepower

Prerequisites to configuring the connector

• You must have the URL of the Cisco Firepower server to which you will connect and perform automated operations, and the credentials (username-password pair) to access that server.
• To access the FortiSOAR™ ensure that port 443 is open through the firewall for the FortiSOAR™ instance.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Cisco Firepower connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 onwards:

operation: List Access Policy

Input parameters

Output

The output contains the following populated JSON schema:

{
    "links": {
        "self": ""
    },
    "items": [
        {
            "type": "",
            "links": {
                "self": ""
            },
            "name": "",
            "id": ""
        }
    ],
    "paging": {
        "offset": "",
        "limit": "",
        "count": "",
        "pages": ""
    }
}

operation: Block IP

Input parameters

NOTE: If you have specified IP addresses or networks that already exist as blocked items in the Network Group Object that you have specified, then the Cisco Firepower connector does not perform any action, i.e., it skips adding the specified IP addresses or networks to the specified Network Group Object.

Output

The output contains the following populated JSON schema:

{
    "existing": [],
    "newly_added": [],
    "not_found": [],
    "removed": []
}

operation: Unblock IP

Input parameters

NOTE: If you have specified IP addresses or networks that do not exist as blocked items in the Network Group Object that you have specified, then the Cisco Firepower connector does not perform any action, i.e., it skips removing the specified IP addresses or networks from the specified Network Group Object.

Output

The output contains the following populated JSON schema:

{
    "existing": [],
    "newly_added": [],
    "not_found": [],
    "removed": []
}

operation: Delete Access Policy

Input parameters

Output

The output contains the following populated JSON schema:

{
    "links": {
        "self": ""
    },
    "items": [
        {
            "type": "",
            "links": {
                "self": ""
            },
            "name": "",
            "id": ""
        }
    ],
    "paging": {
        "offset": "",
        "limit": "",
        "count": "",
        "pages": ""
    }
}

operation: List Device

Input parameters

Output

The output contains the following populated JSON schema:

{
    "items": [],
    "links": {},
    "paging": {
        "pages": "",
        "count": "",
        "offset": "",
        "limit": ""
    }
}

operation: Assign Policy To Device

Input parameters

Output

The output contains a non-dictionary value.

Included playbooks

The Sample - Cisco Firepower - 3.0.2 playbook collection comes bundled with the Cisco Firepower connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Cisco Firepower connector.

• Block IP
• List Access Policy
• Unblock IP
• List Device
• Assign Policy To Device
• Delete Access Policy

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.