Understanding Host Input

The Firepower Management Center provides a tool for importing data from other sources on your network to augment the monitored host information.

There are two ways to use the Host Input API to submit network map information, either by running the nmimport tool on the Management Center, or by using a remote client. In either case, you specify the network map details in a text file with comma-separated values (CSV format). Using the Host Input Import Tool gives general instructions, defines the CSV file format, and describes how to use the nmimport tool. Configuring Host Input Clients describes how to use a Host Import client.

For example, if you are setting up a new Firepower System, you might want to make sure that all the computers listed in your asset management software exist in the network map. You could export the host data from the asset management application, format the results into an appropriately formatted text file, and import the host data using the host input import tool. If the asset management system includes operating system information for each host, you can set up a third-party product map for the asset management system and map each third-party operating system label to the corresponding Cisco label. You can set that map before you run the import, and the system will associate the appropriate Cisco operating system definition with each host.

 

There are four major steps to using the host input import tool with the Firepower Management Center:

1. If you want to perform impact correlation using third-party host data, you can configure third-party product maps to map service, operating system, or fix definitions to Cisco product or fix definitions, using the Management Center web interface.

2. If you want to import third-party vulnerabilities, you can configure third-party vulnerability maps to map third-party vulnerability identification strings to Cisco vulnerability IDs, using the Management Center web interface. Note that you can also perform this mapping in your import file.

3. Export data from a third-party application and format it as a CSV file, as described in Using the Host Input Import Tool.

4. Submit the CSV file using either the nmimport tool or a Host Input client.

Prerequisites

To understand the information in this guide, you should be familiar with the features and nomenclature of the Firepower Management Center and the function of its components (in particular, the network map), and with the various related event data the system generates. Information about these functions, together with definitions of unfamiliar or product-specific terms, may be obtained from the Firepower Management Center Configuration Guide. Additional information about the data fields documented in this guide may be obtained from the Configuration Guide as well.

Product Version Compatibility

The following table describes the product version required for various host input functionality:

 

Table 1-1 Product Version Compatibility

Functionality

Product Version

Host input functionality

Firepower Management Center version 4.9+

Host input external client functionality

Firepower Management Center version 5.0+

Host input mobile device identification functionality

Firepower Management Center version 5.1+

IPv6 address support

Firepower Management Center version 5.2+

Multiple domain support

Firepower Management Center version 6.0+

Document Conventions

The following table lists the names used in this book to describe the various data field formats employed in host input calls.

 

Table 1-2 Key Value Data Type Conventions

Data Type

Description

uint

Unsigned integer

uint8

Unsigned 8-bit integer

uint32

Unsigned 32-bit integer

string

Variable length bytes containing character data.

Host Input Scripting Resources

The following describes some of the topics explained in the documentation and where to look for more information.

 

Table 3 Host Input Resources

To learn more about...

Look in...

the host input import tool

Using the Host Input Import Tool

guidelines for writing an import file to use with the host input import tool

Writing Host Input Import Files

syntax for a specific host input function to include in an import file

Host Input Import Syntax

running the host input import tool

Running a Host Input Import

installing, configuring, and running the host input reference client

Using the Host Input Reference Client