Cisco Cisco Firepower Management Center 2000 Guía Del Desarrollador
![Cisco](https://files.manualsbrain.com/attachments/7380d0050044647c30f5c24bbbf5d0c0b6d9bb84/common/fit/150/50/faa183d287233c52228cfea3dbc2a127fe780f60564fcb0955d9c3d1cd23/brand_logo.png)
3-21
FireSIGHT System Remediation API Guide
Chapter 3 Communicating with the Remediation Subsystem
Defining Remediation Types
The following diagram illustrates the child elements of the
remediation_type
element.
The following table describes the attributes and child elements available to the
remediation_type
element.
The following portion of a
module.template
file illustrates several
remediation_type
element
definitions.
<remediation_type name="block_src">
<display_name>Block Source</display_name>
<policy_event_data>
<pe_item>src_ip_addr</pe_item>
<pe_item>src_port</pe_item>
<pe_item>src_protocol</pe_item>
</policy_event_data>
</remediation_type>
<remediation_type name="block_dest">
<display_name>Block Destination</display_name>
<policy_event_data>
<pe_item>dest_ip_addr</pe_item>
<pe_item>dest_port</pe_item>
Table 3-13
remediation_type Attributes and Child Elements
Name
Type
Description
Required?
name
attribute
Provides context to the remediation module for the remediation
type.
type.
This attribute is required and accepts a string between 1 and 64
characters, inclusive. Names may not contain white space and may
only contain alphanumeric characters and the underscore (_) and
dash (-) character.
characters, inclusive. Names may not contain white space and may
only contain alphanumeric characters and the underscore (_) and
dash (-) character.
remediation_type
names must be unique within
each module.
yes
display_name
element
Labels the remediation type on the web interface.
yes
policy_event_data
element
Specifies the correlation event data that the remediation module
needs to receive from the remediation subsystem.
needs to receive from the remediation subsystem.
The
policy_event_data
has one child element,
pe_item
, that
represents a specific correlation event data item. Use multiple
pe_item
elements to provide multiple correlation event data items.
For more information on appropriate correlation event data values,
see
see
no
config_template
element
Specifies the information the user must provide when configuring
an instance of this remediation module. For more information, see
an instance of this remediation module. For more information, see
.
no