Interpret basic Python scripts used to call Cisco Security appliances APIs

📘CCNP security (350-701)

---

This topic does not test you as a programmer.
For the SCOR exam, Cisco expects you to read and understand simple Python scripts that interact with Cisco Security products using APIs.

Your goal is to:

• Understand what the script is doing
• Identify key Python components
• Recognize how Cisco security appliances are managed using APIs

You are not expected to write complex Python code.

---

1. Why Python Is Used with Cisco Security Appliances

Cisco security appliances (such as Firepower, ISE, Umbrella, SecureX, etc.) expose REST APIs.

Python is commonly used because it:

• Is simple and readable
• Has built-in and third-party libraries for HTTP requests
• Is widely used for automation and orchestration

Common Use Cases in IT Security Environments

• Retrieve security events or alerts
• Get device status and health
• Add or remove security rules
• Automate repetitive security tasks
• Integrate Cisco tools with SIEM or SOAR platforms

---

2. Key Concepts You Must Know for the Exam

Before looking at scripts, understand these core ideas:

2.1 API (Application Programming Interface)

An API allows software to communicate with another system.

Cisco security APIs usually:

• Use REST
• Communicate over HTTPS
• Exchange data using JSON

---

2.2 REST API Basics (Exam-Critical)

REST APIs use HTTP methods:

Method	Purpose
GET	Retrieve information
POST	Create new data
PUT	Update existing data
DELETE	Remove data

Example in security:

• GET → Get security alerts
• POST → Create an access policy
• PUT → Modify a firewall rule
• DELETE → Remove a rule

---

2.3 JSON Format

Cisco APIs send and receive data in JSON (JavaScript Object Notation).

JSON is:

• Human readable
• Key-value based
• Easy to parse in Python

Example:

{
  "id": "123",
  "name": "Blocked_IP",
  "action": "deny"
}

---

3. Common Python Libraries Used with Cisco APIs

3.1 requests Library (Very Important)

The requests library is the most common Python library used to:

• Send HTTP requests
• Call Cisco REST APIs

You should recognize:

import requests

---

3.2 json Library

Used to:

• Convert JSON data
• Read API responses

import json

---

4. Structure of a Basic Python API Script (Exam Focus)

Almost all Cisco API scripts follow this structure:

1. Import libraries
2. Define API URL
3. Set authentication
4. Set headers
5. Send HTTP request
6. Process the response

You should be able to interpret each step.

---

5. Interpreting a Basic Python Script (Line-by-Line)

Example Script: GET Data from a Cisco Security Appliance

import requests
import json

What This Means:

• Imports required libraries
• requests → for API calls
• json → for handling data

---

url = "https://security-appliance/api/v1/alerts"

Meaning:

• Defines the API endpoint
• This endpoint retrieves security alerts

---

headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer ACCESS_TOKEN"
}

Meaning:

• Content-Type → Data format (JSON)
• Authorization → Token used to authenticate with the Cisco appliance
• Cisco APIs commonly use Bearer tokens

---

response = requests.get(url, headers=headers, verify=False)

Meaning:

• Sends an HTTP GET request
• headers=headers → Sends authentication info
• verify=False → Ignores SSL certificate warnings (often seen in labs)

---

print(response.status_code)

Meaning:

• Displays the HTTP response code

Common codes:

Code	Meaning
200	Success
201	Created
401	Unauthorized
403	Forbidden
404	Not found

---

data = response.json()
print(data)

Meaning:

• Converts API response from JSON into Python format
• Displays the returned security data

---

6. Authentication Methods You Must Recognize

Cisco security APIs commonly use:

6.1 API Token Authentication (Most Common)

• Token is generated from the appliance
• Token is included in headers

"Authorization": "Bearer TOKEN"

---

6.2 Basic Authentication (Less Common)

requests.get(url, auth=("username", "password"))

Exam focus:

• Know what authentication is being used
• Understand where credentials or tokens are placed

---

7. POST Request Example (Creating Data)

payload = {
    "name": "New_Rule",
    "action": "block"
}

Meaning:

• Data being sent to the Cisco appliance
• Usually a policy, rule, or configuration

---

response = requests.post(url, headers=headers, json=payload)

Meaning:

• Sends data to the API
• Used to create security objects

---

8. Error Handling (Basic Awareness)

You may see:

if response.status_code == 200:
    print("Success")
else:
    print("Error")

Meaning:

• Checks if the API call was successful
• Helps administrators identify failures

---

9. Security Considerations (Exam Relevant)

Understand why security matters in API scripts:

• APIs expose powerful control
• Tokens must be protected
• HTTPS is mandatory
• Scripts should avoid hard-coding credentials

Cisco expects you to understand:

• Why authentication is required
• Why encrypted communication is used

---

10. How This Appears in the Exam

You may be asked to:

• Identify what a Python script is doing
• Recognize GET vs POST vs DELETE
• Understand authentication headers
• Interpret JSON payloads
• Identify response status meanings

You will NOT be asked to:

• Write a full Python program
• Debug complex scripts
• Memorize Python syntax deeply

---

11. Key Exam Takeaways (Must Remember)

✔ Python is used to automate Cisco security tasks
✔ Cisco APIs are REST-based and use JSON
✔ requests library is commonly used
✔ Understand headers, tokens, and URLs
✔ GET = retrieve, POST = create, PUT = update, DELETE = remove
✔ Focus on interpretation, not coding

---

12. Simple One-Line Summary (For Non-IT Learners)

Python scripts use APIs to securely communicate with Cisco security systems so administrators can automatically monitor, configure, and manage security tools.