Cisco Secure Firewall (SSE)

Creates a new access rule for an existing access policy in Cisco Secure Firewall and returns the rule ID and JSON-formatted body.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Add Access Rule to Access Policy

prod-nam

prod-eu

prod-apjc

Adds a source and/or destination host object to an access rule. If a given host object's ID is left blank, "any" will be used.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if a rule ID or JSON body was provided:
[]> If a rule ID was given, fetch the existing rule and store its JSON in a local variable
[]> If a JSON body was given, extract the rule ID
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Add Host Object to Access Rule

Adds a source and/or destination network group to an access rule.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if a rule ID or JSON body was provided:
[]> If a rule ID was given, fetch the existing rule and store its JSON in a variable
[]> If a JSON body was given, extract the rule ID and store it in a variable
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Add Network Group to Access Rule

Adds a network object to a network group.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if a group ID or JSON body was provided:
[]> If a group ID was given, fetch the existing group and store its JSON in a variable
[]> If a JSON body was given, extract the group ID and store it in a variable
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Add Network Object to Network Group

Adds a port group to an access rule.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if an access rule ID or JSON body was provided:
[]> If an access rule ID was given, fetch the existing access rule and store its JSON in a variable
[]> If a JSON body was given, extract the access rule ID and store it in a variable
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Add Port Group to Access Rule

Adds a port object to an access rule.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if an access rule ID or JSON body was provided:
[]> If an access rule ID was given, fetch the existing access rule and store its JSON in a variable
[]> If a JSON body was given, extract the access rule ID and store it in a variable
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Add Port Object to Access Rule

Adds a port/protocol object to a port group.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if a group ID or JSON body was provided:
[]> If a group ID was given, fetch the existing group and store its JSON in a variable
[]> If a JSON body was given, extract the group ID and store it in a variable
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Add Port Object to Port Group

Adds a URL group to an access rule.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if an access rule ID or JSON body was provided:
[]> If an access rule ID was given, fetch the existing access rule and store its JSON in a variable
[]> If a JSON body was given, extract the access rule ID and store it in a variable
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Add URL Group to Access Rule

Adds a URL object to a URL group.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Make sure the required input was provided
[] Check if a group ID or JSON body was provided:
[]> If a group ID was given, fetch the existing group and store its JSON in a variable
[]> If a JSON body was given, extract the group ID and store it in a variable
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Add URL Object to URL Group

Creates a new access policy in Cisco Secure Firewall and returns the policy ID and JSON-formatted body.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Create Access Policy

Creates a new dynamic object group in Cisco Secure Firewall.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Create Dynamic Object Group

Creates a new network for the given domain UUID.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Create Network Group

Creates a new object.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Create Object

Searches for an access policy by name.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Build the initial URL to request
[] Loop through each page of policies
[]> Generate the JSON payload
[]> Send the API request to the SSE API proxy
[]> Check if the request was successful (if not, return an error)
[]> Check if the proxied request was successful:
[]>> If it wasn't, return an error
[]> Check if a matching policy was found:
[]>> If it was, extract the policy's ID, set the output variables, and end the loop
[]>> If it wasn't:
[]>>> Check for a next page
[]>>>> If there's a next page, update the local URL variable and continue
[]>>>> If there isn't a next page, end the workflow

Secure Firewall - SSE - Get Access Policy by Name

Searches the access policy provided for a rule with the given name.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Build the initial URL to request
[] Loop through each page of rules
[]> Generate the JSON payload
[]> Send the API request to the SSE API proxy
[]> Check if the request was successful (if not, return an error)
[]> Check if the proxied request was successful:
[]>> If it wasn't, return an error
[]> Check if a matching rule was found:
[]>> If it was, extract the rule's ID, set the output variables, and end the loop
[]>> If it wasn't:
[]>>> Check for a next page
[]>>>> If there's a next page, update the local URL variable and continue
[]>>>> If there isn't a next page, end the workflow

Secure Firewall - SSE - Get Access Rule by Name

Gets a list of audit records from Cisco Secure Firewall.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Get Audit Records

Gets information about a single device or, if no device ID is provided, all devices.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Check if a device ID was provided:
[]> If it was, update the local filter variable
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Get Device Details

Gets the mappings for a dynamic object group from Cisco Secure Firewall.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, extract the group mappings and set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Get Dynamic Object Group Mappings

Gets a list of health alerts based on the filters provided.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Process the input and filters
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Get Health Alerts

Gets a single network group using its ID for the given domain UUID.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Get Network Group by ID

Gets a single network group using its name for the given domain UUID.

Note: This only searches the first 100 groups

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it wasn't, return an error
[] Attempt to extract the group by name
[] Set the output variables with the results

Secure Firewall - SSE - Get Network Group by Name

Gets a list of network groups for the given domain UUID.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

Secure Firewall - SSE - Get Network Groups

Searches for objects of the given type with the given name.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Build the initial URL to request
[] Loop through each page of objects
[]> Generate the JSON payload
[]> Send the API request to the SSE API proxy
[]> Check if the request was successful (if not, return an error)
[]> Check if the proxied request was successful:
[]>> If it wasn't, return an error
[]> Check if a matching object was found:
[]>> If it was, set the output variables and end the loop
[]>> If it wasn't:
[]>>> Check for a next page
[]>>>> If there's a next page, update the local URL variable and continue
[]>>>> If there isn't a next page, end the workflow

Secure Firewall - SSE - Get Object by Name

Searches for objects of the given type with the given value. Supported object types: fqdns, hosts, networks, ports, urls

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Build the initial URL to request
[] Loop through each page of objects
[]> Generate the JSON payload
[]> Send the API request to the SSE API proxy
[]> Check if the request was successful (if not, return an error)
[]> Check if the proxied request was successful:
[]>> If it wasn't, return an error
[]> Check if a matching object was found:
[]>> If it was, set the output variables and end the loop
[]>> If it wasn't:
[]>>> Check for a next page
[]>>>> If there's a next page, update the local URL variable and continue
[]>>>> If there isn't a next page, end the workflow

Secure Firewall - SSE - Get Object by Value

Searches for port objects with the given port and protocol.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Build the initial URL to request
[] Loop through each page of objects
[]> Generate the JSON payload
[]> Send the API request to the SSE API proxy
[]> Check if the request was successful (if not, return an error)
[]> Check if the proxied request was successful:
[]>> If it wasn't, return an error
[]> Check if a matching object was found:
[]>> If it was, set the output variables and end the loop
[]>> If it wasn't:
[]>>> Check for a next page
[]>>>> If there's a next page, update the local URL variable and continue
[]>>>> If there isn't a next page, end the workflow

Secure Firewall - SSE - Get Port Object by Port and Protocol

Gets a single URL group using its name for the given domain UUID.

Note: This only searches the first 100 groups

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it wasn't, return an error
[] Attempt to extract the group by name
[] Set the output variables with the results

Secure Firewall - SSE - Get URL Group by Name

Updates the mappings for a dynamic object group in Cisco Secure Firewall. This atomic can be used to append new mappings, remove specific mappings, or remove all mappings.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it wasn't, return an error

Secure Firewall - SSE - Update Dynamic Object Group Mappings

Updates the literals of an existing network group for the given domain UUID.

Note: This atomic is for use with the SecureX SSE API proxy. For more information about how this works, see: https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/api-types

Target: HTTP Endpoint for "visibility.amp.cisco.com" with a path of "/iroh"

Account Key: None (uses an access token)

Steps:
[] Generate the JSON payloads
[] Send the API request to the SSE API proxy
[] Check if the request was successful:
[]> If it wasn't, return an error
[] Extract the result of the proxied request
[] Check if the proxied request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error