NGFW Prefilter Remediation Module

This project implements a remediation module workflow for Cisco NGFW environments.

When a correlation rule is triggered, the module extracts:

• source IP
• destination IP
• service port

Then it adds a fastpath prefilter rule on the triggering NGFW's corresponding ACP/prefilter policy via API.

FMC Quick Install

If your goal is to install the remediation module directly on FMC:

1. Download package: ngfw_prefilter_fastpath_module.tar.gz
2. Open FMC: Policies > Actions > Modules
3. Upload the package and create a module instance
4. Configure FMC connection and target prefilter policy name
5. Bind remediation type (connection_fastpath, connection_analyze, or connection_block) to correlation policy response

Detailed installation and troubleshooting guide:

• module/README.md

What this repository provides

• A production-oriented Python reference implementation
• Event payload schema and validation
• FMC API client with retry support
• Idempotent rule creation logic
• Test scaffolding and CI workflow
• GitHub-ready documentation and contribution files

Architecture at a glance

1. Correlation event is received.
2. Event fields are normalized into remediation conditions.
3. Module identifies target FMC and prefilter policy for the event's NGFW.
4. Module checks existing prefilter rules (dedup guard).
5. Module creates a fastpath rule if needed.
6. Module writes an audit-friendly result.

See detailed design in docs/architecture.md.

Quick start

1. Create virtual environment

python3 -m venv .venv
source .venv/bin/activate

2. Install package (dev mode)

pip install -e .[dev]

3. Prepare config

cp examples/config.example.yaml config.yaml

Fill in FMC host, credentials/token, domain UUID, and policy mapping.

4. Dry run with sample event

ngfw-rm run --config config.yaml --event-file examples/event.sample.json --dry-run

5. Execute for real

ngfw-rm run --config config.yaml --event-file examples/event.sample.json

Expected event fields

• device_id (triggering NGFW identifier)
• src_ip
• dst_ip
• service_port
• protocol (optional; defaults to tcp)

Security notes

• Prefer token auth over hardcoded username/password.
• Store secrets in environment variables or secret manager.
• Use least-privilege API role in FMC.

See SECURITY.md for details.

Repository layout

.
├── src/ngfw_prefilter_rm/
├── tests/
├── docs/
├── examples/
└── .github/workflows/

Status

This is a reference implementation. Validate endpoint details against your FMC version.