topic Hi , in Network Security

Security Intelligence Events table is empty on FMC

SIMMN — Fri, 21 Feb 2020 14:13:21 GMT

I have a FMC virtual appliance v6.2.0.2 with VDB 287. Just realized that there is nothing recorded under Security Intelligence Events page. There are entries under connection event page though. Two ASA with Firepower services are connected.

I do have valid protection license installed. There is no error regarding Security Intelligence updates. I also check Security Intelligence objects.

Network: Feed updates every two hours; Global-Whitelist is empty and one entry in Global-Blacklist
DNS: Feed updates every two hours; Global-Whitelist and Global-Blacklist are empty
URL: There is no Feed and Global-Whitelist and Global-Blacklist are empty (what will be the feed URL if I want to add a Feed?)

Ideas?

Hi ,

Dinesh Verma — Sat, 12 Aug 2017 01:08:07 GMT

Hi ,

I want you to check if you've added those categories under blacklist (Both Network and URL). Please take a look to the screenshot attached.

Feed—Dynamic collection that updates on an interval over HTTP or HTTPS (Third Party or anything).

Hope this helps.

Regards,
Dv

I do have those two in the

SIMMN — Sat, 12 Aug 2017 01:18:04 GMT

I do have those two in the blacklist. Mine is attached.

Those two are blank and are

Dinesh Verma — Sat, 12 Aug 2017 02:39:24 GMT

Those two are blank and are for you to add IP/URL explicitly. Add the categories there under blacklist. Attached screenshot for the reference.

Regards,

Thanks, I will schedule time

SIMMN — Sat, 12 Aug 2017 04:12:18 GMT

Thanks, I will schedule time to put relative categories in. I thought the security intelligence feed retrieved blacklists are sufficient...