Cisco Platforms and Development · Topic 4 of 8
Cisco Security Platforms and APIs
Learn what Cisco XDR, Firepower and FMC, Secure Connect, Secure Endpoint, ISE and Secure Malware Analytics do and how their APIs fit together.
- 5 min
- Includes a diagram
- XDR correlates data from many tools and automates the response.
- FMC manages Firepower firewalls, and its REST API uses a token from a generatetoken call.
- Secure Connect is a cloud delivered service for secure connectivity, in the SASE idea.
What it is
Cisco security platforms protect networks, endpoints and users, and most of them expose APIs so that security tasks can be automated.
The outline names six: XDR, Firepower, Secure Connect, Secure Endpoint, ISE and Secure Malware Analytics. Each has a different job, from detection and response to access control and malware analysis.
The exam asks you to match a product to a capability, so focus on what each one is for.
How it works
Security automation links products together, so one product's finding can trigger another product's action.
Cisco XDR
XDR, or extended detection and response, collects telemetry from many security tools and the network. It correlates the findings into incidents and helps analysts respond.
It succeeds the earlier SecureX platform. It offers an API and automation workflows, so a response step, such as blocking a file hash or isolating a host, can run without manual work.
Firepower and Secure Firewall Management Center
Firepower is the Cisco next generation firewall line, now branded Secure Firewall. It combines firewalling with intrusion prevention, application control, URL filtering and malware protection.
Management Center, or FMC, manages many firewalls. It has a REST API that supports reading and changing objects and access policies. You log in first and then use the token.
POST /api/fmc_platform/v1/auth/generatetoken
Authorization: Basic BASE64_OF_USER_AND_PASSWORDThe reply carries the access token and the domain in its headers. You send the token in the X-auth-access-token header on later calls.
Configuration paths sit under /api/fmc_config/v1/domain/ followed by the domain ID. The firewall objects you manage include network objects, access policies and rules.
Secure Connect
Secure Connect is a Cisco cloud delivered service that combines secure access and connectivity for branch sites and remote users. It belongs to the secure access service edge, or SASE, idea, in which security and networking are delivered from the cloud.
For the exam, remember it only as a cloud delivered way to connect and protect sites and users. Product details and names change over time, so check Cisco documentation before relying on them.
Secure Endpoint
Secure Endpoint was formerly called AMP for Endpoints. An agent on each computer or server watches for malware and suspicious behaviour, and a cloud console manages the agents.
Its API lets you list the computers, read events, manage lists of files that are blocked or allowed, and isolate a host. Access uses an API client ID and key.
Cisco ISE
The Identity Services Engine is the policy platform for network access control. It authenticates users and devices, profiles them, checks posture, and then authorises access, for example with a VLAN or a security group tag.
ISE offers several APIs:
| API | Use |
|---|---|
| ERS, the external RESTful services API | Create, read, update and delete objects such as endpoints, groups and network devices |
| OpenAPI | Newer REST API in the same product |
| pxGrid | Share session and context data with other security products |
| Monitoring API | Read session and log information |
The ERS API is switched off until an administrator enables it, and it uses basic authentication with an account that has ERS rights. Older documentation uses port 9060 over HTTPS for it, so check the port for your release.
Secure Malware Analytics
Secure Malware Analytics was formerly called Threat Grid. It runs suspicious files and URLs in a sandbox, records what they do, and returns a threat score and behaviour report.
The API lets you submit samples and fetch the results, which makes it easy to build automatic analysis into other tools. Access uses an API key.
Comparing the platforms
| Platform | Main purpose | Typical API task |
|---|---|---|
| XDR | Detect, investigate and respond across tools | Read incidents, run a response workflow |
| Firepower and FMC | Next generation firewall management | Create objects and policies |
| Secure Connect | Cloud delivered connectivity and security | Central management of sites and users |
| Secure Endpoint | Endpoint malware protection | List computers, isolate a host |
| ISE | Network access control | Manage endpoints and groups |
| Secure Malware Analytics | Sandbox analysis | Submit a file and get a score |
An example workflow
Secure Endpoint spots a suspicious file. A script submits the file to Secure Malware Analytics for a score. If the score is high, the script isolates the host with the Secure Endpoint API and creates a block entry through the firewall API.
For a product matching question, ask what the product protects. Endpoints point to Secure Endpoint, network access points to ISE, firewalls point to FMC, and cross tool response points to XDR.
What to remember for the exam
Six facts cover this topic.
- XDR correlates data from many tools and automates the response.
- FMC manages Firepower firewalls, and its REST API uses a token from a generatetoken call.
- Secure Connect is a cloud delivered service for secure connectivity, in the SASE idea.
- Secure Endpoint protects endpoints, and it was formerly AMP for Endpoints.
- ISE controls network access, and ERS is its REST API for managing objects.
- Secure Malware Analytics, formerly Threat Grid, is a sandbox that scores files.
Common mistakes
Four mistakes are typical.
Mixing up ISE and a firewall. ISE decides who gets access. A firewall filters traffic.
Forgetting the old product names. AMP for Endpoints and Threat Grid are the earlier names for Secure Endpoint and Secure Malware Analytics.
Calling the FMC API without logging in first. You need a token from the generatetoken call.
Forgetting to enable ERS. The API is off until an administrator turns it on.
Security APIs hold powerful rights. Protect their keys and tokens, and give automation accounts only the access they need.
Check yourself
Work through these three questions.
Which product is a sandbox that returns a threat score for a file?
Secure Malware Analytics, formerly Threat Grid.
How do you authenticate to the FMC REST API?
You send a login request to the generatetoken path with basic authentication, then use the returned token in later requests.
What is the job of ISE?
ISE is the network access control platform. It authenticates and profiles users and devices and then authorises their access.
Topic 4 of 8 in Cisco Platforms and Development
Test yourself on Cisco Platforms and Development
The full Cisco CCNA 200-901 DEVASC question bank has 808 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.