Cisco ASA Response Integration via API

🔹 Configuring Cisco ASA API for Logsign USO Integration

To integrate Cisco ASA with Logsign USO via API, you must create a dedicated API user with the necessary permissions. This user will be responsible for executing security response actions, including:

✔️ Create Network Object (create-network-object)

✔️ Perform ASA Configuration Backup (asa-backup)

✔️ Restore ASA Configuration (asa-restore)

Once the user is created, you will enter the required details in Logsign USO under Settings > Responses, selecting Cisco ASA API and filling in the fields shown in the provided image.

🔹 Step 1: Creating an API User on Cisco ASA

The API user must be configured with the necessary privileges to execute administrative actions.

1.1 Creating the User via Cisco ASA Web Interface (ASDM UI)

         1. Log in to Cisco ASDM (Adaptive Security Device Manager).

         2. Navigate to Configuration → Device Management → Users/AAA → User Accounts.

         3. Click Add and enter the following details:

·   Username: logsign_api_user

·   Password: (Set a strong password and store it securely)

·   Privilege Level: 15 (To allow full execution of API commands)

         4. In the User Role Configuration section, assign the following permissions:

·   “Security Administrator” → (Allows creating network objects)

·   “System Administrator” → (Allows system-wide configuration actions, including backups and restores)

·   “API Access” → (Enables API interaction)

         5. Click OK → Apply to save the changes.

1.2 Creating the API User via Cisco ASA CLI (Command Line)

Alternatively, the user can be created via the Cisco ASA CLI with the following commands:

conf t

username logsign_api_user password YOUR_SECURE_PASSWORD privilege 15

privilege exec level 15 rest-api

privilege exec level 15 configure terminal

privilege exec level 15 show running-config

privilege exec level 15 copy running-config startup-config

privilege exec level 15 backup

privilege exec level 15 restore

exit

write memory

🔹 Explanation of the commands:

• username logsign_api_user password YOUR_SECURE_PASSWORD privilege 15 → Creates a user with full privileges.
• privilege exec level 15 rest-api → Grants access to the ASA REST API.
• privilege exec level 15 configure terminal → Allows the user to modify configurations.
• privilege exec level 15 show running-config → Grants permission to view the ASA configuration.
• privilege exec level 15 copy running-config startup-config → Allows backup creation.
• privilege exec level 15 backup → Enables ASA backup operations.
• privilege exec level 15 restore → Grants permission to restore configurations.
• write memory → Saves the configuration.

🔹 Step 2: Enabling API Services on Cisco ASA

By default, API access may not be enabled on Cisco ASA. To ensure that Logsign USO can communicate with the firewall, enable the ASA REST API service.

Enable API via CLI

conf t

rest-api agent

http server enable

http 192.168.1.100 255.255.255.255 inside

exit

write memory

🔹 Explanation:

• rest-api agent → Enables the API service.
• http server enable → Activates the ASA web server (required for API).
• http 192.168.1.100 255.255.255.255 inside → Allows API access from the SIEM server’s IP address.
• write memory → Saves the changes.

🔹 Step 3: Assigning the User to Logsign USO

Once the API user is created and API access is enabled, enter the details into Logsign USO to complete the integration.

1. Log in to Logsign USO.
2. Navigate to Settings > Responses.
3. Select Cisco ASA API as the response method.
4. Fill in the required fields using the API user credentials:

·   Device Name: (Custom identifier for the ASA firewall in Logsign USO)

·   Host: (Cisco ASA IP address or hostname)

·   Username: logsign_api_user

·   Password: (Password created for the user)

·   Port: 443 (Default API port)

5.          Click “Create” to save the configuration.

✅ Summary

• A new API user was created with full administrative privileges to execute create-network-object, asa-backup, and asa-restore actions.
• API access was enabled on Cisco ASA, allowing secure communication with Logsign USO.
• The credentials were entered into Logsign USO, enabling the automation of firewall tasks.

🚀 Cisco ASA is now fully integrated with Logsign USO via API!