Cisco Cisco Firepower Management Center 2000 开发者指南
1-2
FireSIGHT System Host Input API Guide
Chapter 1 Understanding Host Input
Prerequisites
Step 5
Run the script to import the data.
There are five major steps to using the host input import tool with the FireSIGHT System:
Step 1
If you want to perform impact correlation using third-party host data, you can configure third-party
product maps to map service, operating system, or fix definitions to Cisco product or fix definitions,
using the Defense Center web interface.
product maps to map service, operating system, or fix definitions to Cisco product or fix definitions,
using the Defense Center web interface.
Step 2
If you want to import third-party vulnerabilities, you can configure third-party vulnerability maps to map
third-party vulnerability identification strings to Cisco vulnerability IDs, using the Defense Center web
interface. Note that you can also perform this mapping in your import file.
third-party vulnerability identification strings to Cisco vulnerability IDs, using the Defense Center web
interface. Note that you can also perform this mapping in your import file.
Step 3
Export data from a third-party application and format it to match the formatting guidelines provided in
.
Step 4
Run the import tool.
Step 5
To use the import tool, log in as
admin
on your Defense Center. Use the import tool to set the third-party
product map. Use the import tool to import data from the import file you created.
Prerequisites
To understand the information in this guide, you should be familiar with the features and nomenclature
of the FireSIGHT System and the function of its components (in particular, the network map), and with
the various related event data the system generates. Information about these functions, together with
definitions of unfamiliar or product-specific terms, may be obtained from the FireSIGHT System User
Guide. Additional information about the data fields documented in this guide may be obtained from the
User Guide as well.
of the FireSIGHT System and the function of its components (in particular, the network map), and with
the various related event data the system generates. Information about these functions, together with
definitions of unfamiliar or product-specific terms, may be obtained from the FireSIGHT System User
Guide. Additional information about the data fields documented in this guide may be obtained from the
User Guide as well.
Product Version Compatibility
The following table describes the product version required for various host input functionality:
Table 1-1
Product Version Compatibility
Functionality
Product Version
Host input functionality
FireSIGHT System version 4.9+
ScanUpdate
function,
AddHostAttribute
function,
DeleteHostAttribute
function,
SetSourceType
function,
DeleteScanResult
function,
AddScanResult
function,
ScanFlush
function, setting source types, setting source type
IDS
FireSIGHT System version 4.10+
Host input external client functionality
FireSIGHT System version 5.0+
Host input mobile device identification functionality
FireSIGHT System version 5.1+
DeleteClientApp
function
FireSIGHT System version 5.1.1+
IPv6 address support
FireSIGHT System version 5.2+