Cisco Firepower Threat Defense

Introduction

Cisco Firepower Threat Defense is an integrative software image combining Cisco ASA and Firepower features into one hardware and software inclusive system.

The Cisco Firepower NGIPS is a next generation intrusion prevention system that shares a management console with the Cisco firewall offerings, called the Firepower Management Center.

Cisco ASA Firepower Services provides the following key capabilities:

1. Access control: This policy based capability allows a network security administrator to define, inspect, and log the traffic that traverses a firewall. Access control policies determine how traffic is permitted or denied in a network. For instance, you can configure a default action to inspect all traffic or block or trust all traffic without further inspection. You can achieve a more complete access control policy with enrichment data based on security threat intelligence. Whether you configure simple or complex rules, you can control traffic based on security zones, network or geographical locations, ports, applications, requested URLs, and per user.

2. Intrusion detection and prevention: Intrusion detection and prevention help you detect attempts from an attacker to gain unauthorized access to a network or host, create performance degradation, or steal information. You define intrusion detection and prevention policies based on your access control policies. Create and tune custom policies at a very granular level to specify how traffic is inspected in a network.

3. AMP and file control: You can detect, track, capture, analyze, and optionally block the transmission of files, including malware files and nested files inside archive files in network traffic. File control enables you to detect and block users from sending or receiving files of different specific types over a multitude of application protocols. You can configure file control as part of the overall access control policies and application inspection.

4. Application programming interfaces (APIs): Cisco ASA Firepower Services supports several ways to interact with the system using APIs.

Pre-Requisites

The OpsRamp Gateway must be installed.

Configure and install the integration

1. Go to Setup > Integrations and Apps.
2. Click + ADD on the INSTALLED APP page. The AVAILABLE APPS page displays all the available applications along with the newly created application with the version.
   Notes:
   • If there are already installed applications, it will redirect to the INSTALLED APPS page, where all the installed applications are displayed.
   • If there are no installed applications, it will navigate to the ADD APP page.
   • You can even search for the application using the search option available. Also you can use the All Categories option to search.

3. Click ADD in the Cisco Firepower Threat Defense application.
4. Select an existing registered profile, and click Next.
5. In the Configurations page, click + ADD. The Add Configuration page appears.
6. Enter the below mentioned BASIC INFORMATION:

Notes:

• By default the Is Secure checkbox is selected. Select the following:
  • App Failure Notifications: if turned on, you will be notified in case of an application failure that is, Connectivity Exception, Authentication Exception.
  • Alert Configuration: map alert configuration for third party alerts into OpsRamp.
• Below are the default values set for:
  • Alert Severity: possible values of Alert Severity filter configuration property are “RED”,“YELLOW”.
  • Alert Severity Mapping: possible values of Alert Severity Mapping filter configuration property are “RED”:“Critical”,“YELLOW”:“Warning”.

7. In the RESOURCE TYPE section, select:

   • ALL: All the existing and future resources will be discovered.
   • SELECT: You can select one or multiple resources to be discovered.

8. In the DISCOVERY SCHEDULE section, select Recurrence Pattern to add one of the following patterns:

   • Minutes
   • Hourly
   • Daily
   • Weekly
   • Monthly

9. Click ADD.
   

10. Now the configuration is saved and displayed on the configurations page after you save it. From the same page, you may Edit and Remove the created configuration.

11. Click Finish.

The application is now installed and displayed on the Installed Integration page. Use the search field to find the installed application.

Modify the Configuration

• See Modify an Installed Integration or Application article.

  Note: Select the Cisco Firepower Threat Defense application.

View the Cisco Firepower Threat Defense device details

The Cisco Firepower Threat Defense application integration is displayed in the below navigation:

• FMC: Infrastructure > Resources > Server.

• FTD: Infrastructure > Resources > Network Device > Firewall.

Supported Metrics

Risks, Limitations & Assumptions

• As of now the application only supports discovery and monitoring for FTDs managed by FMC or FDM.
• Application can handle Critical/Recovery failure notifications for below two cases when user enables App Failure Notifications in configuration:
  • Connectivity Exception (ConnectTimeoutException, HttpHostConnectException, UnknownHostException)
  • Authentication Exception (UnauthorizedException)
• Application will not send any duplicate/repeat failure alert notification until the already existed critical alert is recovered.
• Application cannot control monitoring pause/resume actions based on above alerts.
• Metrics can be used to monitor FTD resources and can generate alerts based on the threshold values.
• Event/Alert polling will start only if the user enables Event/Alert Polling in configuration.
• Possible values of Event/Alert Severity filter configuration property are kWarning, kCritical, kInfo.
• OpsRamp has given sample mappings to map FTD Severity with OpsRamp Severities as part of the Event/Alert Severity Mapping configuration file. You can modify them as per their use case at any point of time from the SDK application configuration page. Possible OpsRamp Severities are Critical, Warning, Ok, Info.
• No support of showing activity log and applied time.
• No support for the option to get Latest snapshot metric.
• Interfaces under FTD are represented as Network devices in OpsRamp.