The firepower management council can be configured with correlation policies that can send alerts and
even take action if specific events that you define are triggered to help show you how you can build
correllation rules to distinguish significant alerts.
I'm going to get into the lab fire power management center to build a correlation rule.
All right.
So to start off with our correlation policies we're going to want to go to policies and then correlation
Okay.
So before I create a correlation policy first I want to make my rule that will be used to match on an
event so I'll go to the rule management tab and then create rule.
So for this example I'm going to create a correlation for if there are any mail or events so I call
this rule mail where events.
So here we have intrusion events you can match on Discovery.
So you could actually trigger an event on a Firepower.
Notice that there was a new Saab introduced to the firepower.
Apology user misconnection but I'm going to select a malware event occurs and then I'm going to select
a network based malware detection because I have fire power appliances within the lab network and I
don't have the amp and base solution within the lab so I'm just going to match our network based malware
detection.
And then if you wanted to be more specific if you hit this dropdown you could choose things like which
application protocol you want it to match on file type IP addressing.
I'm going to choose the disposition which is the status of the file is it a clean file or known or malware.
And then is malwares the default option.
So I just want to know if any network based malware events occur in my network.
I want to be notified.
So I'll hit save.
So we have a rule which is the event we're matching on.
And then ultimately when we create our policy that's going to say if this event occurs we're going to
apply this action.
So we haven't created or action yet.
So let's go ahead and do that.
We'll go to actions and then alerts
as you can see here.
I already have a CIS log alert define.
But for this example we'll create an SMP alert because SMP I trap server IP address
on my SMP information using S&P version 3.
That's kind of lame that you can only slatted does.
I would think that on a secure device like this you could pick A-S something but it's only SMP.
So no big deal.
Save
All right now that we have our alert created as you can see here it shows that it's not in use but it
is enabled so once we create our policy and tie our rule and alert it together it'll show as in use.
So we'll go back to policies and correllation
and we'll create a new correllation policy.
All right so a call this malware policy
that we have to add our rule to it.
So we'll choose our malware events rule.
Click at
so in other words policy knows what to match on.
We have to give a response.
So we'll go here to the responses at Barton and then we'll assign a response to it.
So I select my ass and and the other I created push it up and hit update.
All right so that's it.
Now we have our malware policy defined in firepower so that we can be alerted if there are any significant
malware events.