Firepower Management Center REST API Submit Snort Rules

[jfeild001]

Greetings Cisco Community,

I am looking to automate the process of adding intrusion rules to a Firepower device (FMC version 6.2.0). I was hoping to be able to use the REST API for this purpose, but looking through the documentation, it's unclear to me whether this action is supported.

Is adding Snort rules via the REST API supported? I apologize if I've overlooked something obvious.

Thanks in advance,

J

[neipatel · Accepted solution]

J,

Today it is not possible to modify or Tune IPS policy with the REST API. To add and adjust Snort rules in Firepower Management Center you must use the UI. 

All you can do with the API and identify and IPS policy and apply it to to rules.

Regards,

Neil

[jfeild001]

Neil,

Thank you very much for your quick reply and the clarification!

-J

[nwilu0001]

Hi Neil,

Following on from your response, would it possible to export the SNORT rules using the API?

[neipatel]

nwilu0001,

It is not possible to export the SNORT signature contents for a specific IPS rule with the API. It is only possible to identify and apply the Rule as a whole (By name and system generated GUID) with the API. For visibility into the rule you would again have to use the UI.

Regards,

Neil

[nwilu0001]

Thank you for replying so quickly Neil.

[fredymaiz84543]

Hello,

any updates on the subject?

is there an option to upload Snort rules to the FMC using API?

is there a road map for the functionality?

[kbliss]

I am curious how this has changed in version 7. I know that I can get the intrusion rules using the FMC API now. It appears that I can also modify rules. Is there the ability to install local rules in bulk using the FMC API now? 

[osanniko]

There is a newer API that allows to create custom snort 3 rules within FMC. You can find it under /object/intrusionrules in FMC API explorer.