Update Inspector Override Config - Security Cloud Control Firewall Manager API Documentation

{"type":"api","title":"Update Inspector Override Config","meta":{"id":"/apps/pubhub/media/cdo-api-documentation/ee9bdf946673e45c4f256a22e0a754e29a9b2098/54f4ba30-7fe2-3433-bbd5-a4d458aee37e","info":{"title":"Cisco Cloud-delivered Firewall Management Center (cdFMC) API","version":"1.15.0","description":"Use the documentation to explore the endpoints the cdFMC has to offer","contact":{"name":"Cisco Firepower TAC","email":"ngfw-support@cisco.com"}},"tags":[{"name":"Analysis"},{"name":"Audit"},{"name":"Backup"},{"name":"Change Management"},{"name":"Chassis"},{"name":"Deployment"},{"name":"Device Clusters"},{"name":"Device Groups"},{"name":"Device HA Pairs"},{"name":"Devices"},{"name":"Health"},{"name":"Integration"},{"name":"Intelligence"},{"name":"License"},{"name":"Network Map"},{"name":"Object"},{"name":"Policy"},{"name":"Policy Assignments"},{"name":"Search"},{"name":"Status"},{"name":"System Configuration"},{"name":"System Information"},{"name":"Templates"},{"name":"Troubleshoot"},{"name":"Updates"},{"name":"Users"}],"openapi":"3.0.1","servers":[{"url":"https://api.us.security.cisco.com/firewall","description":"US"},{"url":"https://api.eu.security.cisco.com/firewall","description":"EU"},{"url":"https://api.apj.security.cisco.com/firewall","description":"APJ"},{"url":"https://api.au.security.cisco.com/firewall","description":"AUS"},{"url":"https://api.in.security.cisco.com/firewall","description":"IN"},{"url":"https://api.int.security.cisco.com/firewall","description":"Staging"},{"url":"https://scale.manage.security.cisco.com/api/rest","description":"Scale"},{"url":"https://ci.manage.security.cisco.com/api/rest","description":"CI"},{"url":"https://manage.stg.secure.cisco/api/rest","description":"Stgf9"}],"securitySchemes":{"bearerAuth":{"bearerFormat":"JWT","scheme":"bearer","type":"http"}}},"spec":{"deprecated":false,"description":"**Modify the inspector override configuration associated with the specified policy. An inspector override allows the user to modify behaviour specified in the base policy inspector configuration. _Check the response section for applicable examples (if any)._**","operationId":"updateInspectorOverrideConfig","parameters":[{"description":"UUID of the ticket for tracking the configuration changes.","in":"header","name":"ticket-id","required":false,"schema":{"type":"string"}},{"description":"The container id under which this specific resource is contained.","in":"path","name":"containerUUID","required":true,"schema":{"type":"string"}},{"name":"domainUUID","description":"Domain UUID","in":"path","required":true,"schema":{"type":"string"},"$$ref":"#/components/parameters/domainUUID"}],"requestBody":{"content":{"application/json":{"examples":{"Example 1 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Enabling a Singleton inspector when default state in the Base Policy is disable )":{"value":{"inspectorOverrideConfig":{"rate_filter":{"data":[],"enabled":true,"type":"singleton"}},"type":"InspectorOverrideConfig"}},"Example 2 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Disabling a Singleton inspector when default state in the Base Policy is enable )":{"value":{"inspectorOverrideConfig":{"rate_filter":{"data":[],"enabled":false,"type":"singleton"}},"type":"InspectorOverrideConfig"}},"Example 3 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Enabling a Multiton inspector when default state in the Base Policy is disable )":{"value":{"inspectorOverrideConfig":{"ssh":{"enabled":true,"instances":[],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 4 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Disabling a Multiton inspector when default state in the Base Policy is enable )":{"value":{"inspectorOverrideConfig":{"iec104":{"enabled":false,"instances":[],"type":"multiton"},"ssh":{"enabled":false,"instances":[],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 5 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Overriding default value of specific setting(s) for Singleton inspector )":{"value":{"inspectorOverrideConfig":{"normalizer":{"data":{"ip6":true,"tcp":{"block":true}},"enabled":true,"type":"singleton"}},"type":"InspectorOverrideConfig"}},"Example 6 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Overriding specific setting(s) of a default instance (where instance name matches with inspector type) in Multiton inspector )":{"value":{"inspectorOverrideConfig":{"http_inspect":{"enabled":true,"instances":[{"data":{"unzip":false},"name":"http_inspect"}],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 7 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Adding binder rule for a default instance with required changes (default binder rules cannot be really edited, they are always appended at the end) )":{"value":{"inspectorOverrideConfig":{"binder":{"enabled":true,"rules":[{"use":{"type":"http_inspect"},"when":{"dst_nets":"10.1.1.0/24","role":"server","service":"http"}}],"type":"binder"}},"type":"InspectorOverrideConfig"}},"Example 8 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Adding a new custom instance. Corresponding Binder rule entry must be defined in the binder module )":{"value":{"inspectorOverrideConfig":{"binder":{"enabled":true,"rules":[{"use":{"name":"telnet_my_instance","type":"telnet"},"when":{"role":"any","service":"telnet"}}],"type":"binder"},"telnet":{"enabled":true,"instances":[{"data":{"encrypted_traffic":true},"name":"telnet_my_instance"}],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 9 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Overriding a Singleton instance (normalizer inspector), overriding a Multiton default instance (http_inspect inspector) and creating a new Multiton instance (telnet inspector) )":{"value":{"inspectorOverrideConfig":{"binder":{"enabled":true,"rules":[{"use":{"name":"telnet_my_instance","type":"telnet"},"when":{"role":"any","service":"telnet"}},{"use":{"type":"http_inspect"},"when":{"dst_nets":"10.1.1.0/24","role":"server","service":"http"}}],"type":"binder"},"http_inspect":{"enabled":true,"instances":[{"data":{"unzip":false,"xff_headers":"x-forwarded-for true-client-ip x-another-forwarding-header"},"name":"http_inspect"}],"type":"multiton"},"normalizer":{"data":{"ip6":true,"tcp":{"block":true}},"enabled":true,"type":"singleton"},"telnet":{"enabled":true,"instances":[{"data":{"encrypted_traffic":true},"name":"telnet_my_instance"}],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 10 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Configuring arp_spoof inspector )":{"value":{"inspectorOverrideConfig":{"arp_spoof":{"data":{"hosts":[{"ip":"1.1.1.1","mac":"ff:0f:f1:0f:0f:ff"},{"ip":"2.2.2.2","mac":"ff:0f:f2:0f:0f:ff"}]},"enabled":true,"type":"singleton"}},"type":"InspectorOverrideConfig"}},"Example 11 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Configuring rate filter )":{"value":{"inspectorOverrideConfig":{"rate_filter":{"data":[{"apply_to":"[10.1.2.100, 10.1.2.101]","count":5,"gid":135,"new_action":"alert","seconds":1,"sid":1,"timeout":5,"track":"by_src"}],"enabled":true,"type":"singleton"}},"type":"InspectorOverrideConfig"}},"Example 12 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Configuring Smtp list alt_max_command_line_len. Give the entire list in overrides )":{"value":{"inspectorOverrideConfig":{"smtp":{"enabled":true,"instances":[{"data":{"alt_max_command_line_len":[{"command":"ATRN","length":255},{"command":"AUTH","length":246},{"command":"BDAT","length":255},{"command":"DATA","length":246},{"command":"XEXCH50","length":246},{"command":"X-EXPS","length":246}]},"name":"smtp"}],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 13 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Removing all the inspector overrides for NAP policy )":{"value":{"inspectorOverrideConfig":{},"type":"InspectorOverrideConfig"}}},"schema":{"type":"object","description":"Object representing modified inspector settings for network analysis policy.","properties":{"description":{"type":"string"},"id":{"type":"string"},"inspectorOverrideConfig":{"type":"object","additionalProperties":{"type":"object","$$ref":"#/components/schemas/Object"},"description":"The schema of this payload is dynamic and based on the OpenAPI schema received from the latest installed Lightweight Security Package.","$$ref":"#/components/schemas/LLInspectorOverrideConfig"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"type":"object","properties":{"domain":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IDomain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IMetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","properties":{"reason":{"enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"type":"boolean"}},"$$ref":"#/components/schemas/IReadonly"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/IMetadata"},"name":{"type":"string"},"type":{"description":"Type of the object. This value is always 'InspectorOverrideConfig'.","type":"string"},"version":{"description":"Version number of the response object.","type":"string"}},"$$ref":"#/components/schemas/InspectorOverrideConfig"}}},"description":"Input representation of inspector override configuration.","required":true},"responses":{"200":{"content":{"application/json":{"examples":{"Example 1 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Enabling a Singleton inspector when default state in the Base Policy is disable )":{"value":{"inspectorOverrideConfig":{"rate_filter":{"data":[],"enabled":true,"type":"singleton"}},"type":"InspectorOverrideConfig"}},"Example 2 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Disabling a Singleton inspector when default state in the Base Policy is enable )":{"value":{"inspectorOverrideConfig":{"rate_filter":{"data":[],"enabled":false,"type":"singleton"}},"type":"InspectorOverrideConfig"}},"Example 3 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Enabling a Multiton inspector when default state in the Base Policy is disable )":{"value":{"inspectorOverrideConfig":{"ssh":{"enabled":true,"instances":[],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 4 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Disabling a Multiton inspector when default state in the Base Policy is enable )":{"value":{"inspectorOverrideConfig":{"iec104":{"enabled":false,"instances":[],"type":"multiton"},"ssh":{"enabled":false,"instances":[],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 5 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Overriding default value of specific setting(s) for Singleton inspector )":{"value":{"inspectorOverrideConfig":{"normalizer":{"data":{"ip6":true,"tcp":{"block":true}},"enabled":true,"type":"singleton"}},"type":"InspectorOverrideConfig"}},"Example 6 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Overriding specific setting(s) of a default instance (where instance name matches with inspector type) in Multiton inspector )":{"value":{"inspectorOverrideConfig":{"http_inspect":{"enabled":true,"instances":[{"data":{"unzip":false},"name":"http_inspect"}],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 7 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Adding binder rule for a default instance with required changes (default binder rules cannot be really edited, they are always appended at the end) )":{"value":{"inspectorOverrideConfig":{"binder":{"enabled":true,"rules":[{"use":{"type":"http_inspect"},"when":{"dst_nets":"10.1.1.0/24","role":"server","service":"http"}}],"type":"binder"}},"type":"InspectorOverrideConfig"}},"Example 8 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Adding a new custom instance. Corresponding Binder rule entry must be defined in the binder module )":{"value":{"inspectorOverrideConfig":{"binder":{"enabled":true,"rules":[{"use":{"name":"telnet_my_instance","type":"telnet"},"when":{"role":"any","service":"telnet"}}],"type":"binder"},"telnet":{"enabled":true,"instances":[{"data":{"encrypted_traffic":true},"name":"telnet_my_instance"}],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 9 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Overriding a Singleton instance (normalizer inspector), overriding a Multiton default instance (http_inspect inspector) and creating a new Multiton instance (telnet inspector) )":{"value":{"inspectorOverrideConfig":{"binder":{"enabled":true,"rules":[{"use":{"name":"telnet_my_instance","type":"telnet"},"when":{"role":"any","service":"telnet"}},{"use":{"type":"http_inspect"},"when":{"dst_nets":"10.1.1.0/24","role":"server","service":"http"}}],"type":"binder"},"http_inspect":{"enabled":true,"instances":[{"data":{"unzip":false,"xff_headers":"x-forwarded-for true-client-ip x-another-forwarding-header"},"name":"http_inspect"}],"type":"multiton"},"normalizer":{"data":{"ip6":true,"tcp":{"block":true}},"enabled":true,"type":"singleton"},"telnet":{"enabled":true,"instances":[{"data":{"encrypted_traffic":true},"name":"telnet_my_instance"}],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 10 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Configuring arp_spoof inspector )":{"value":{"inspectorOverrideConfig":{"arp_spoof":{"data":{"hosts":[{"ip":"1.1.1.1","mac":"ff:0f:f1:0f:0f:ff"},{"ip":"2.2.2.2","mac":"ff:0f:f2:0f:0f:ff"}]},"enabled":true,"type":"singleton"}},"type":"InspectorOverrideConfig"}},"Example 11 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Configuring rate filter )":{"value":{"inspectorOverrideConfig":{"rate_filter":{"data":[{"apply_to":"[10.1.2.100, 10.1.2.101]","count":5,"gid":135,"new_action":"alert","seconds":1,"sid":1,"timeout":5,"track":"by_src"}],"enabled":true,"type":"singleton"}},"type":"InspectorOverrideConfig"}},"Example 12 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Configuring Smtp list alt_max_command_line_len. Give the entire list in overrides )":{"value":{"inspectorOverrideConfig":{"smtp":{"enabled":true,"instances":[{"data":{"alt_max_command_line_len":[{"command":"ATRN","length":255},{"command":"AUTH","length":246},{"command":"BDAT","length":255},{"command":"DATA","length":246},{"command":"XEXCH50","length":246},{"command":"X-EXPS","length":246}]},"name":"smtp"}],"type":"multiton"}},"type":"InspectorOverrideConfig"}},"Example 13 : PUT /fmc_config/v1/domain/DomainUUID/policy/networkanalysispolicies/containerUUID/inspectoroverrideconfigs ( Removing all the inspector overrides for NAP policy )":{"value":{"inspectorOverrideConfig":{},"type":"InspectorOverrideConfig"}}},"schema":{"type":"object","description":"Object representing modified inspector settings for network analysis policy.","properties":{"description":{"type":"string"},"id":{"type":"string"},"inspectorOverrideConfig":{"type":"object","additionalProperties":{"type":"object","$$ref":"#/components/schemas/Object"},"description":"The schema of this payload is dynamic and based on the OpenAPI schema received from the latest installed Lightweight Security Package.","$$ref":"#/components/schemas/LLInspectorOverrideConfig"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"type":"object","properties":{"domain":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IDomain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IMetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","properties":{"reason":{"enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"type":"boolean"}},"$$ref":"#/components/schemas/IReadonly"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/IMetadata"},"name":{"type":"string"},"type":{"description":"Type of the object. This value is always 'InspectorOverrideConfig'.","type":"string"},"version":{"description":"Version number of the response object.","type":"string"}},"$$ref":"#/components/schemas/InspectorOverrideConfig"}}},"description":"OK"},"default":{"content":{"application/json":{"schema":{"type":"object","properties":{"category":{"description":"Describes the category of the error thrown.","enum":["FRAMEWORK","OTHER","VALIDATION"],"type":"string"},"messages":{"description":"List of error messages which the response has.","items":{"type":"object","properties":{"bulkPayloadIndex":{"description":"More details about the error.","type":"string"},"code":{"description":"More details about the error.","type":"string"},"description":{"description":"More details about the error.","type":"string"},"details":{"description":"More details about the error.","type":"string"},"errorCode":{"description":"More details about the error.","type":"string"},"location":{"description":"More details about the error.","type":"string"},"severity":{"description":"Specifies the Highest level severity among all the error messages.","enum":["ERROR","WARN"],"type":"string"}},"$$ref":"#/components/schemas/ErrorMessagesContainer"},"type":"array"},"severity":{"description":"Specifies the Highest level severity among all the error messages.","enum":["ERROR","WARN"],"type":"string"}},"$$ref":"#/components/schemas/ErrorResponse"}}},"description":"Error"}},"tags":["Policy"],"__originalOperationId":"updateInspectorOverrideConfig","method":"put","path":"/v1/cdfmc/api/fmc_config/v1/domain/{domainUUID}/policy/networkanalysispolicies/{containerUUID}/inspectoroverrideconfigs"}}