topic Firepower Management Center REST API Submit Snort Rules in Network Security

Firepower Management Center REST API Submit Snort Rules

jfeild001 — Fri, 21 Feb 2020 14:02:17 GMT

Greetings Cisco Community,

I am looking to automate the process of adding intrusion rules to a Firepower device (FMC version 6.2.0). I was hoping to be able to use the REST API for this purpose, but looking through the documentation, it's unclear to me whether this action is supported.

Is adding Snort rules via the REST API supported? I apologize if I've overlooked something obvious.

Thanks in advance,

J,

neipatel — Tue, 14 Mar 2017 16:43:11 GMT

Today it is not possible to modify or Tune IPS policy with the REST API. To add and adjust Snort rules in Firepower Management Center you must use the UI.

All you can do with the API and identify and IPS policy and apply it to to rules.

Regards,

Neil

Neil,

jfeild001 — Tue, 14 Mar 2017 16:54:33 GMT

Neil,

Thank you very much for your quick reply and the clarification!

-J

Hi Neil,

nwilu0001 — Fri, 19 May 2017 12:25:55 GMT

Hi Neil,

Following on from your response, would it possible to export the SNORT rules using the API?

nwilu0001,

neipatel — Fri, 19 May 2017 12:58:27 GMT

nwilu0001,

It is not possible to export the SNORT signature contents for a specific IPS rule with the API. It is only possible to identify and apply the Rule as a whole (By name and system generated GUID) with the API. For visibility into the rule you would again have to use the UI.

Regards,

Neil

Thank you for replying so

nwilu0001 — Fri, 19 May 2017 14:26:45 GMT

Thank you for replying so quickly Neil.

Re: Firepower Management Center REST API Submit Snort Rules

fredymaiz84543 — Wed, 25 Dec 2019 11:34:45 GMT

Hello,

any updates on the subject?

is there an option to upload Snort rules to the FMC using API?

is there a road map for the functionality?

Re: Firepower Management Center REST API Submit Snort Rules

kbliss — Fri, 02 Sep 2022 14:56:07 GMT

I am curious how this has changed in version 7. I know that I can get the intrusion rules using the FMC API now. It appears that I can also modify rules. Is there the ability to install local rules in bulk using the FMC API now?

Re: Firepower Management Center REST API Submit Snort Rules

osanniko — Tue, 16 Jan 2024 15:21:29 GMT

There is a newer API that allows to create custom snort 3 rules within FMC. You can find it under /object/intrusionrules in FMC API explorer.