Cisco Cisco Firepower Management Center 4000 Guía Del Desarrollador
2-44
FireSIGHT System Host Input API Guide
Chapter 2 Using the Host Input API
Example Host Input API Scripts
"BMC Remedy", "Asset Manager", "0.0" ))
{
warn "AddClientApp Failed with error $retval";
exit;
}
Note that the client application ID is set to
BMC Remedy
, the client application type is set to
Asset
Manager
, and the version is set to
0.0
.
Example: Adding a Scan Result to a Host
The script adds the scan results from a third-party scanner that scanned host
1.2.3.4
to the network map.
$params=
{
'scanner_id' => 'Scanner_ID',
'ip_address' => '1.2.3.4'
};
$mapping_vuln_list = [
{
'cve_ids' => [ '2003-0988' ],
'vuln_id' => '10150A',
# 3rd party scanner vuln id
'port' => 107,
'proto' => 17,
'name' => 'Using NetBIOS to retrieve info from a Windows host',
'desc' => 'The following 2 NetBIOS names have been gathered ...',
},
{
'cve_ids' => [],
'bugtraq_ids' => [ 29506,29507,29508 ],
'vuln_id' => '10159B',
# 3rd party scanner vuln id
'port' => 109,
'proto' => 17,
'name' => 'Name 2',
'desc' => 'description 2',
},
];
$generic_item_list = [];
$flag =
getPkgVar("SF::SFDataCorrelator::UserMessage",'$UPDATE_SCAN_RESULT');
# Send message indicating that you are updating scan result and set
# flag to append the scan result to existing scan results on the host
SF::SFDataCorrelator::HostInput::AddScanResult($params,
$mapping_vuln_list,$generic_item_list,$flag);
Example: Adding a Generic Scan Result to a Host
The script adds a generic scan result to the network map.
my ($scanner_id,$vuln_id,$mapping_vuln_id);
my $ip = '1.2.3.4';
$scanner_id = 'Scanner_ID';
$mapping_vuln_list = [];
$generic_item_list = [
{
'port' => 107,
'proto' => 17,