Cisco Cisco Firepower Management Center 2000 Guía Del Desarrollador

Descargar
Página de 60
 
3-21
FireSIGHT System Remediation API Guide
 
Chapter 3      Communicating with the Remediation Subsystem
  Defining Remediation Types
The following diagram illustrates the child elements of the 
remediation_type
 element.
The following table describes the attributes and child elements available to the 
remediation_type 
element.
The following portion of a 
module.template
 file illustrates several 
remediation_type
 element 
definitions.
<remediation_type name="block_src">
<display_name>Block Source</display_name>
<policy_event_data>
<pe_item>src_ip_addr</pe_item>
<pe_item>src_port</pe_item>
<pe_item>src_protocol</pe_item>
</policy_event_data>
</remediation_type>
<remediation_type name="block_dest">
<display_name>Block Destination</display_name>
<policy_event_data>
<pe_item>dest_ip_addr</pe_item>
<pe_item>dest_port</pe_item>
Table 3-13
remediation_type Attributes and Child Elements 
Name
Type
Description
Required?
name
attribute
Provides context to the remediation module for the remediation 
type. 
This attribute is required and accepts a string between 1 and 64 
characters, inclusive. Names may not contain white space and may 
only contain alphanumeric characters and the underscore (_) and 
dash (-) character. 
remediation_type
 names must be unique within 
each module.
yes
display_name
element
Labels the remediation type on the web interface.
yes
policy_event_data
element
Specifies the correlation event data that the remediation module 
needs to receive from the remediation subsystem.
The 
policy_event_data
 has one child element, 
pe_item
, that 
represents a specific correlation event data item. Use multiple 
pe_item
 elements to provide multiple correlation event data items. 
For more information on appropriate correlation event data values, 
see 
no
config_template
element
Specifies the information the user must provide when configuring 
an instance of this remediation module. For more information, see 
.
no