Purpose
This guide explains how to configure the Cisco Firepower Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, add or remove an IP from a Dynamic Object on Cisco Firepower Management Center (FMC) to block or unblock it. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device; it is unrelated to the separate "Cisco FirePower Syslog Forwarding" log collection guide.
How blocking actually works: the FMC API used by this integration does not add IPs directly into a firewall rule. It adds/removes IPs from a Dynamic Object (an IP list). For blocking to take effect on the firewall, your FMC must already have a BLOCK rule in the relevant Access Control Policy that references this Dynamic Object as its Source or Destination, and that policy must be deployed to the managed devices. If you have not set this up yet, see the separate Cisco FMC Response Integration User Guide, which documents the Dynamic Object + BLOCK rule setup in detail for a related (but separate, RuleName/Dynamic-Object-based) FMC integration. This guide's "add-ip"/"remove-ip" methods and the FMC guide's RuleName-based method are two different Logsign integrations against the same underlying FMC concept; confirm which one your Action Rule is actually configured to call.
Prerequisites
- A Cisco Firepower Management Center (FMC) reachable from the Logsign server.
- An FMC account with API access and permission to modify the Dynamic Object this integration will use.
- Use least privilege. Create a dedicated FMC user for this integration, scoped to the minimum role that allows reading and modifying Dynamic Objects, rather than a full System Administrator account.
- A Dynamic Object already created on FMC, referenced by a BLOCK rule in the Access Control Policy that is actually deployed to your managed devices. See the "How blocking actually works" note above.
Step 1: Prepare FMC for API Access
- Log in to Cisco FMC with an administrator account.
- Create (or designate) a dedicated user for Logsign to use, with API access enabled and permission to read/modify Dynamic Objects.
- Note the FMC hostname/IP, the port it listens on for API access, and the username/password for the account.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Cisco Firepower, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Firepower device in Logsign. |
| Host | Yes | Hostname or IP address of your FMC. |
| Port | Yes | Port FMC's API listens on (typically 443). |
| Protocol | Yes | Typically https. |
| Username | Yes | The FMC account username from Step 1. |
| Password | Yes | Password for that account. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls to FMC when enabled. Leave off unless you have a specific reason (for example a self-signed internal certificate) to keep it on. |
Click Create to save the device.
Available Methods
- add-ip (Containment) — adds an IP to the Dynamic Object, triggering a block if a BLOCK rule referencing that object is deployed.
- remove-ip (Recovery) — removes an IP from the Dynamic Object.
- dynamic-object-list (Analysis) — fetches the current contents of the Dynamic Object, useful for confirming an add/remove actually took effect.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Username/Password. | Re-enter the Username and Password fields and confirm the account can log in to FMC directly. |
| 403 Forbidden | The account does not have permission to modify Dynamic Objects. | Confirm the account's assigned role in FMC includes Dynamic Object read/write access. |
| add-ip succeeds but the IP is not actually blocked | No BLOCK rule references the Dynamic Object, the referencing Access Control Policy was never deployed, or the wrong Access Control Policy was edited. | See the "How blocking actually works" note above; confirm a BLOCK rule referencing this Dynamic Object exists in the policy actually applied to your managed devices, and that the policy has been deployed after any change. |
Notes and Limits
- This integration does not deploy policy changes to managed devices by itself; adding an IP to the Dynamic Object only changes the list's contents. If your FMC deployment requires an explicit "Deploy" step after object changes for them to take effect on devices, confirm whether that applies to Dynamic Object changes in your FMC version, since this varies by release.
- The exact FMC console navigation path for creating an API user was not independently verified against a live FMC during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.