Installing Custom Remediation Modules on FMC

In this lesson, you will learn how custom remediation modules extend Cisco Secure Firewall Management Center by connecting security events to automated response workflows.

The article explains the remediation architecture, installation workflow, module configuration, correlation-policy integration, verification, and essential security precautions.

What Is FMC Remediation?

A remediation is an automated response that Cisco Secure Firewall Management Center can launch when a monitored condition violates an associated correlation policy.

Instead of limiting the workflow to event detection and manual investigation, remediation can pass event information to a program that performs a predefined response.

Depending on the module and its design, the response could interact with a firewall, router, endpoint platform, external intelligence service, ticketing system, or another security application.

What Is a Custom Remediation Module?

A custom remediation module is a packaged application installed on FMC to provide remediation actions beyond the default actions supplied by Cisco.

A module can define:

• The module name and version
• The executable program used for remediation
• Configuration values entered by the administrator
• The remediation actions exposed in FMC
• The correlation-event information required by each action
• The exit statuses returned after execution

The custom code determines what action is performed. FMC supplies the event context and launches the configured remediation when the associated correlation rule is triggered.

Remediation Workflow

The general workflow is:

1. FMC receives and analyzes security or network events.
2. A correlation rule evaluates the event conditions.
3. The rule triggers when its configured conditions are satisfied.
4. The correlation policy launches the assigned remediation.
5. FMC passes the required event information to the module.
6. The custom program performs the external action.
7. The module returns a success or failure status.
8. The administrator verifies both the FMC event and the external result.

Example Use Cases

Custom remediation modules can support workflows such as:

• Adding a malicious IP address to a block list
• Submitting an observable to an external threat-intelligence service
• Creating a ticket in an incident-management platform
• Sending event information to a security orchestration platform
• Quarantining a workload through an integrated security system
• Launching a controlled host-assessment workflow
• Updating an external database or internal application
• Calling an approved API to perform a predefined response

The video demonstrates a custom application that can be adapted to workflows such as malicious-IP handling and external threat-intelligence enrichment.

Prerequisites

Before installing a custom remediation module, verify:

• Administrative access to FMC
• Compatibility with the deployed FMC version
• A correctly packaged remediation module
• Required external API or service connectivity
• DNS and routing for external destinations
• Valid API credentials when required
• Documented correlation-rule conditions
• A rollback and module-removal procedure
• A non-production environment for initial testing

Review the module code and package contents before installation. Only trusted and tested modules should be uploaded to FMC.

Installing the Module

The module is installed from the remediation-module management page in FMC.

1. Log in to Cisco Secure Firewall Management Center.
2. Navigate to Policies > Actions > Modules.
3. Locate the section used to install a new module.
4. Click Browse.
5. Select the packaged remediation-module file.
6. Upload the module.
7. Review the module name, version, actions, and configuration requirements.
8. Click Install.
9. Confirm that the module appears in the installed-module list.

Menu names may differ between releases. Always follow the administration guide for the FMC version deployed in your environment.

Configuring a Remediation Instance

After installing the module, create a remediation instance containing the settings required by the custom application.

Depending on the module, these settings could include:

• API endpoint or server address
• Authentication token
• Username and password
• Timeout value
• Target list or policy name
• Action mode
• Logging options
• Additional module-specific parameters

1. Open the remediation configuration area.
2. Select the installed custom module.
3. Create a new remediation instance.
4. Enter the required configuration values.
5. Save the instance.
6. Confirm that the instance is available for correlation-policy actions.

Use a dedicated service account with only the permissions required by the remediation action.

Using the Module in a Correlation Policy

Installing a module does not automatically execute it. The remediation instance must be associated with an appropriate correlation rule or policy.

1. Create or identify the correlation rule that detects the required condition.
2. Define specific event criteria to reduce false positives.
3. Add the custom remediation as the rule response.
4. Select the correct remediation instance and action.
5. Review the information that will be passed to the module.
6. Save and activate the correlation policy.
7. Generate a controlled test event.
8. Confirm that the remediation runs only when expected.

Begin with a narrow and controlled rule. An overly broad condition could trigger repeated or unintended actions against legitimate systems.

Video Demonstration

The following video demonstrates the installation and use of a custom remediation module on Cisco FMC.

Verification

After configuration, verify the workflow from detection through external remediation.

1. Confirm that the module is listed as installed.
2. Verify that the remediation instance is saved correctly.
3. Confirm that the instance is associated with the intended correlation rule.
4. Generate a controlled event matching the rule.
5. Verify that the correlation policy triggers.
6. Review the remediation execution result.
7. Confirm that the external platform received the request.
8. Verify that the intended action was completed.
9. Confirm that legitimate traffic or systems were not affected.

Example Validation Questions

• Did the correct IP address or event value reach the module?
• Did the module call the correct API endpoint?
• Was authentication successful?
• Did the module return an accurate exit status?
• Was the action performed only once?
• Can the action be reversed when necessary?

Security Considerations

• Install modules only from trusted and reviewed sources.
• Inspect the source code and package before deployment.
• Do not hard-code credentials in scripts.
• Use minimum-privilege service accounts.
• Protect API keys and authentication tokens.
• Validate all event data before passing it to commands or external APIs.
• Implement timeouts and error handling.
• Prevent duplicate or uncontrolled remediation actions.
• Maintain an allowlist for critical systems that must not be blocked automatically.
• Log every action for auditing and investigation.
• Provide a rollback process for reversible actions.
• Test upgrades before using the module with a newer FMC release.

Automated blocking should always include safeguards. A false positive, malformed event, or overly broad correlation rule could otherwise affect legitimate users or critical infrastructure.

Troubleshooting

The Module Does Not Install

• Verify the package format and file integrity.
• Confirm that required module-definition files are present.
• Check compatibility with the FMC version.
• Review module names, paths, and permissions.
• Examine FMC error messages and logs.

The Remediation Does Not Run

• Confirm that the correlation policy is active.
• Verify that the event matches the rule conditions.
• Confirm that the correct remediation instance is assigned.
• Review required event fields.
• Check the module execution result and logs.

The External API Call Fails

• Verify DNS and network connectivity.
• Confirm the API endpoint and port.
• Check authentication credentials and permissions.
• Review certificate-validation errors.
• Confirm that the request format is accepted by the external service.
• Check for API rate limits.

The Remediation Runs More Than Once

• Review the correlation-rule conditions and frequency.
• Implement duplicate-event suppression.
• Check whether multiple policies use the same remediation.
• Add logic that verifies whether the requested action already exists.

Conclusion

Custom remediation modules allow Cisco FMC to connect correlation events with external response applications.

The complete workflow includes installing the module, configuring an instance, associating it with a carefully designed correlation policy, triggering a controlled test event, and validating the external action.

Because remediation can change security controls or affect production systems, every custom module should include strict input validation, minimum-privilege credentials, comprehensive logging, failure handling, safeguards, and a documented rollback process.