Руководство Разработчика для Cisco Cisco Firepower Management Center 2000
2-12
FireSIGHT System Host Input API Guide
Chapter 2 Using the Host Input API
Host Input API Functions
SetService
You can use the
SetService
function to specify the server protocol, vendor, product, and version for a
specified server. You can set display strings for the server using
$service
keys. By mapping a third-party
product in the Defense Center web interface or using the
SetCurrent3rdPartyMap
function (see
), you can associate third-party server data with the vulnerability
information for specific Cisco product definitions.
If the server protocol does not already exist, this call causes a new server identity to be created for the
string. If the specified server does not already exist, the system creates it.
string. If the specified server does not already exist, the system creates it.
The server identity displayed in a host profile is set by the highest priority source. Possible sources have
the following priority order: user, scanner and application (set in the system policy), FireSIGHT, then
NetFlow. Note that a new higher priority server identity will not override a current server identity if it
has less detail than the current identity.
the following priority order: user, scanner and application (set in the system policy), FireSIGHT, then
NetFlow. Note that a new higher priority server identity will not override a current server identity if it
has less detail than the current identity.
If you create a custom server definition for a host, the FireSIGHT System web interface indicates the
source for the change in the Source Type field of the Servers table view of events or the Servers section
of the host profile.
source for the change in the Source Type field of the Servers table view of events or the Servers section
of the host profile.
Note
If the number of servers stored in the network map for a specific host exceeds 100, new server
information is ignored until servers are deleted from the host.
information is ignored until servers are deleted from the host.
Use this syntax:
SetService($source_type_id, $source_id, $addr_string, $attrib_list, $service)
$attrib_list
Indicates the host
attribute or attributes
specifying the hosts
affected by the host
input.
attribute or attributes
specifying the hosts
affected by the host
input.
Yes (unless IP
addresses are
provided)
addresses are
provided)
A list of attribute value hash pairs of the format:
{attribute => “Department”,
value => “Development”},
Note that
$attrib_list
must be an array or
reference an array.
$service
Contains a hash with
keys describing the
details of a server
definition.
keys describing the
details of a server
definition.
If you set a current
third-party map
before calling
before calling
AddService
, only
the rendering and
service_name
or
service_id
keys are
required.
The
$service
variable is a server definition hash
.
Table 2-7
AddService Fields (continued)
Field
Description
Required
Allowed Values