Cisco Cisco Firepower Management Center 4000 Developer's Guide

Page of 102
 
2-25
FireSIGHT System Host Input API Guide
 
Chapter 2      Using the Host Input API
  Host Input API Functions
Tip
You can also specify fixes using the 
SetOS
 and 
SetService
 functions.
Use this syntax:
RemoveFix($source_type_id, $source_id, $addr_string, $attrib_list, $port, $proto, 
$fix)
Table 2-20
RemoveFix Fields 
Field
Description
Required
Allowed Values
$source_type_id
Indicates the type of the 
host input source. 
Yes
“Application” or “Scanner”
Note you should set the 
$source_type_id
 variable to 
contain a value before invoking the 
RemoveFix
 
function, and then reference 
$source_type_id
 in your 
function call. For more information, see 
$source_id
Indicates the source ID 
for the source adding the 
host input. 
Yes
“source_id”
Note you should set the 
$source_id
 variable to 
contain the source ID before invoking the 
RemoveFix
 
function, and then reference 
$source_id
 in your 
function call. For more information, see 
.
$addr_string
Indicates the string 
containing the IP 
address or addresses for 
the affected hosts.
Yes (unless 
attribute lists or 
MAC addresses 
are provided)
A comma-separated list of IP addresses, CIDR blocks, 
and ranges of IP addresses, with each address, block, 
or range enclosed in double quotes.
$attrib_list
Indicates the host 
attribute or attributes 
specifying the hosts 
affected by the host 
input.
Yes (unless IP 
addresses or 
MAC addresses 
are provided)
A list of attribute value hash pairs of the format:
{attribute => “Department”,
value => “Development”},
Note that 
$attrib_list
 must be an array or reference 
an array.
$port
With the 
$proto
 field, 
indicates the server 
affected by the fix.
Yes, if the fix 
applies to a server
Integers in the range of 1-65535, enclosed in double 
quotes.
$proto
With the 
$port
 field, 
indicates the server 
affected by the fix.
No
Either the strings 
tcp
 or 
udp
 or the appropriate 
protocol IDs 
6
 (tcp) or 
17
 (udp).
$fix
Indicates the 
identification string for 
the fix.
Yes
A Cisco fix identification number or a third-party fix 
name, enclosed in double quotes, defined in a 
third-party product map that you use by calling the 
SetCurrent3rdPartyMap
 function before invoking the 
RemoveFix
 function. For more information, see 
.