Cisco WSA Proxy commands For Integrity Monitoring and its important

[bilal-siddiqui]

Dear Community,

I hope you are doing well.

I would appreciate your support in resolving the following query:

What are the recommended commands for Cisco WSA Proxy related to Integrity Monitoring, and what is the significance or purpose of each command?

Your assistance in this matter will be truly valuable and appreciated.

Best regards,
Muhammad Bilal

[amojarra]

@bilal-siddiqui 

I hope you are doing fine 

Can you please more more details, what is the expectations?

Thank you 

[bilal-siddiqui]

Dear amojarra,

I hope you are doing well.

Thank you for your response.

To clarify my request: I am currently using a File Integrity Monitoring (FIM) solution and would like to implement integrity monitoring for our Cisco Web Security Appliance (WSA) proxy. Specifically, I am looking to understand:

What are the critical configuration files or system paths on the Cisco WSA that should be monitored for changes?

Are there any recommended CLI commands or best practices to help identify key configuration files or system state relevant to FIM?

What aspects of the WSA configuration or system state are considered most critical to monitor for integrity (e.g., proxy policies, authentication, SSL inspection, etc.)?

Regards,
Muhammad Bilal

[bilal-siddiqui]

.

[amojarra]

Thank you @bilal-siddiqui 

Regarding the OS file, they are Cisco's internal and you do not have access to them .

Regarding the configuration changes, every items of the Configuration that was changed, without your knowledge is critical and needs to review. 

as far as I know, most of the FIMs, can integrate with the "Change Management System"s . what you can do is:

[1] create an script to log in to WSA's CLI every day, hour, X-hours ,... and execute: saveconfig 

 [1-1] then types 2 , Enter, Enter 

[1-2] get the log's file name 

wsa-1522009.calo.amojarra> saveconfig

Choose the password option:
1. Mask passwords (Files with masked passwords cannot be loaded using loadconfig command)
2. Encrypt passwords
[1]> 2

Do you want the system to generate a name for the configuration file? [Y]>

The file S100V-123456789ABCDEFG-HIJKLMN-20250726T175814.xml has been saved in the configuration directory on machine "wsa-1522009.calo.amojarra".

[2] Make sure the FTP in the WSA is enabled ( GUI > Network > Interfaces > Edit > FTP ) 

[3] FTP to the WSA and navigate to : configuration folder and pull the configuration file and import to your IFM 

Note: you can configure :  SCP push Config backup in the WSA, as soon as there are any configuration Commit, it will send the configuration file to the SCP server 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++     If you find this answer helpful, please rate it as such    ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[bilal-siddiqui]

Dear Amirhossein Mojarrad

Thank you for your detailed and informative response — I truly appreciate your time and support.

To further clarify my request:

I understand that direct OS-level file access is restricted on the Cisco WSA appliance. However, my primary objective is to identify which specific CLI commands expose critical configuration data, so I can regularly monitor those command outputs using the File Integrity Monitoring (FIM) solution that is already integrated with the WSA proxy.

[amojarra]

Thank you @bilal-siddiqui 

Unfortunately, we do not have any CLI command that could help you a lot

the best would be the configuration file itself.

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++     If you find this answer helpful, please rate it as such    ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++