Cisco Secure Firewall

Creates a new access rule for an existing access policy in Cisco Secure Firewall and returns the rule ID and JSON-formatted body.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON for the rule
[] Request the rule be created
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the rule ID
[] Set the output variables

Secure Firewall - Add Access Rule to Access Policy

prod-nam

prod-eu

prod-apjc

Adds a source and/or destination host object to an access rule. If a given host object's ID is left blank, "any" will be used.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if a rule ID or JSON body was provided:
[]> If a rule ID was given, fetch the existing rule and store its JSON in a local variable
[]> If a JSON body was given, extract the rule ID and store it in a local variable
[] Generate the JSON for the updated rule
[] Request the rule be updated
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Add Host Object to Access Rule

Adds a source and/or destination network group to an access rule.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if a rule ID or JSON body was provided:
[]> If a rule ID was given, fetch the existing rule and store its JSON in a variable
[]> If a JSON body was given, extract the rule ID and store it in a variable
[] Generate the JSON for the updated rule
[] Request the rule be updated
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Add Network Group to Access Rule

Adds a network object to a network group.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if a group ID or JSON body was provided:
[]> If a group ID was given, fetch the existing group and store its JSON in a variable
[]> If a JSON body was given, extract the group ID and store it in a variable
[] Generate the JSON for the updated group
[] Request the group be updated
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Add Network Object to Network Group

Adds a port group to an access rule.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if an access rule ID or JSON body was provided:
[]> If an access rule ID was given, fetch the existing access rule and store its JSON in a variable
[]> If a JSON body was given, extract the access rule ID and store it in a variable
[] Generate the JSON for the updated access rule
[] Request the access rule be updated
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Add Port Group to Access Rule

Adds a port object to an access rule.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if an access rule ID or JSON body was provided:
[]> If an access rule ID was given, fetch the existing access rule and store its JSON in a variable
[]> If a JSON body was given, extract the access rule ID and store it in a variable
[] Generate the JSON for the updated access rule
[] Request the access rule be updated
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Add Port Object to Access Rule

Adds a port/protocol object to a port group.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if a group ID or JSON body was provided:
[]> If a group ID was given, fetch the existing group and store its JSON in a variable
[]> If a JSON body was given, extract the group ID and store it in a variable
[] Generate the JSON for the updated group
[] Request the group be updated
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Add Port Object to Port Group

Adds a URL group to an access rule.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if an access rule ID or JSON body was provided:
[]> If an access rule ID was given, fetch the existing access rule and store its JSON in a variable
[]> If a JSON body was given, extract the access rule ID and store it in a variable
[] Generate the JSON for the updated access rule
[] Request the access rule be updated
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Add URL Group to Access Rule

Adds a URL object to a URL group.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if a group ID or JSON body was provided:
[]> If a group ID was given, fetch the existing group and store its JSON in a variable
[]> If a JSON body was given, extract the group ID and store it in a variable
[] Generate the JSON for the updated group
[] Request the group be updated
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Add URL Object to URL Group

Creates a new access policy in Cisco Secure Firewall and returns the policy ID and JSON-formatted body.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON for the policy
[] Request the policy be created
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the policy ID
[] Set the output variables

Secure Firewall - Create Access Policy

Creates a new dynamic object group in Cisco Secure Firewall.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Build the new group object
[] Execute the API request to create the group
[] Check if the request was successful (if not, end the workflow)

Secure Firewall - Create Dynamic Object Group

Creates a new network for the given domain UUID.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Execute the API request to create the network group
[] Check if the request was successful (if not, end the workflow)
[] Set the output variables with the results

Secure Firewall - Create Network Group

Creates a new object.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Attempt to create the object
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the new object's ID
[] Make sure extraction was successful (if not, return an error)
[] Set the output variables

Secure Firewall - Create Object

Searches for an access policy by name.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Build the initial URL to request
[] Loop through each page of policies
[]> Fetch the policies on this page (if this fails, return an error)
[]> Look for a matching policy
[]> Check if a matching policy was found:
[]>> If it was, extract the policy's ID, set the output variables, and end the loop
[]>> If it wasn't:
[]>>> Check for a next page
[]>>>> If there's a next page, update the local URL variable and continue
[]>>>> If there isn't a next page, end the workflow

Secure Firewall - Get Access Policy by Name

Searches the access policy provided for a rule with the given name.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Set the initial URL to request
[] Loop through each page of access rules
[]> Fetch the rules on this page (if this fails, return an error)
[]> Look for matching rules
[]> Check if a matching rule was found:
[]>> If it was, extract the rule's ID, set the output variables, and end the loop
[]>> If it wasn't:
[]>>> Check for a next page
[]>>>> If there's a next page, update the local URL variable and continue
[]>>>> If there isn't a next page, end the workflow

Secure Firewall - Get Access Rule by Name

Fetches an access token and domain information for the Cisco Secure Firewall Management Center API.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: HTTP Basic Authentication with an API account

Steps:
[] Request access token and domain information
[] Check if the request succeeded (if not, end the workflow)
[] Loop through each header, extracting the ones we need to set to output variables

Secure Firewall - Get Access Token

Gets a list of audit records from Cisco Secure Firewall.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Request the audit records
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Get Audit Records

Gets information about a single device or, if no device ID is provided, all devices.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Check if a device ID was provided:
[]> If it was, update the local filter variable
[] Fetch the device details
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Get Device Details

Gets the mappings for a dynamic object group from Cisco Secure Firewall.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center

Account Key: None (uses an access token)

Steps:
[] Execute the API request to get the object group
[] Check if the request was successful (if not, end the workflow)
[] Extract the group mappings
[] Set the output variable

Secure Firewall - Get Dynamic Object Group Mappings

Gets a list of health alerts based on the filters provided.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Process the input and filters
[] Request matching alerts
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - Get Health Alerts

Gets a single network group using its ID for the given domain UUID.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Execute the API request to get the network group
[] Check if the request was successful (if not, end the workflow)
[] Set the output variables with the results

Secure Firewall - Get Network Group by ID

Gets a single network group using its name for the given domain UUID.

Note: This only searches the first 100 groups

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Execute the API request to get the network group
[] Check if the request was successful (if not, end the workflow)
[] Attempt to extract the group by name
[] Set the output variables with the results

Secure Firewall - Get Network Group by Name

Gets a list of network groups for the given domain UUID.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Execute the API request to get network groups
[] Check if the request was successful (if not, end the workflow)
[] Set the output variables with the results

Secure Firewall - Get Network Groups

Searches for objects of the given type with the given name.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Build the initial URL to request
[] Loop through each page of objects
[]> Fetch the objects on this page (if this fails, return an error)
[]> Look for matching objects
[]> Check if a matching object was found:
[]>> If it was, extract the object's ID, set the output variables, and end the loop
[]>> If it wasn't:
[]>>> Check for a next page
[]>>>> If there's a next page, update the local URL variable and continue
[]>>>> If there isn't a next page, end the workflow

Secure Firewall - Get Object by Name

Searches for objects of the given type with the given value. Supported object types: fqdns, hosts, networks, ports, urls

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Build the initial URL to request
[] Loop through each page of objects
[]> Fetch the objects on this page (if this fails, return an error)
[]> Look for matching objects
[]> Check if a matching object was found:
[]>> If it was, extract the object's ID, set the output variables, and end the loop
[]>> If it wasn't:
[]>>> Check for a next page
[]>>>> If there's a next page, update the local URL variable and continue
[]>>>> If there isn't a next page, end the workflow

Secure Firewall - Get Object by Value

Searches for port objects with the given port and protocol.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Build the initial URL to request
[] Loop through each page of objects
[]> Fetch the objects on this page (if this fails, return an error)
[]> Look for matching objects
[]> Check if a matching object was found:
[]>> If it was, extract the object's ID, set the output variables, and end the loop
[]>> If it wasn't:
[]>>> Check for a next page
[]>>>> If there's a next page, update the local URL variable and continue
[]>>>> If there isn't a next page, end the workflow

Secure Firewall - Get Port Object by Port and Protocol

Gets a single URL group using its name for the given domain UUID.

Note: This only searches the first 100 groups

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Execute the API request to get the URL group
[] Check if the request was successful (if not, end the workflow)
[] Attempt to extract the group by name
[] Set the output variables with the results

Secure Firewall - Get URL Group by Name

Updates the mappings for a dynamic object group in Cisco Secure Firewall. This atomic can be used to append new mappings, remove specific mappings, or remove all mappings.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center with a path of "api/"

Account Key: None (uses an access token)

Steps:
[] Execute the API request to update the network object group's mappings
[] Check if the request was successful (if not, end the workflow)

Secure Firewall - Update Dynamic Object Group Mappings

Updates the literals of an existing network group for the given domain UUID.

Note: You may need to use an XDR automation remote to communicate with Cisco Secure Firewall if it's on-premises. See the XDR automation documentation for more information about remotes.

Target: HTTP Endpoint for your Firewall Management Center

Account Key: None (uses an access token)

Steps:
[] Build the new group JSON
[] Execute the API request to update the network group
[] Check if the request was successful (if not, end the workflow)
[] Set the output variables with the results