topic Re: how to get Cisco Security Intelligence feeds in Network Security

how to get Cisco Security Intelligence feeds

h.dam — Tue, 12 Mar 2019 14:04:12 GMT

Hello,

Connecting to FMC via ssh, I saw no Cisco Security Intelligence feeds in the following directories:

/var/sf/iprep_download

/var/sf/sidns_download

/var/sf/sifile_download

/var/sf/siurl_download

I'd like to get these feeds (as files) to complete the SI configuration. Please show me where are they located? I didn't find them in Cisco Talos website nor Cisco software download.

Notice that my FMC, IPS are in an isolated environnement, there is no internet access allowed.

Thanks very much.

Regards.

Re: how to get Cisco Security Intelligence feeds

Abheesh Kumar — Tue, 06 Nov 2018 15:32:36 GMT

To update the SI feed via GUI.

Go to Objects > Object Management > Security Intelligence > Network Lists & Feeds and click update feeds

Objects > Object Management > Security Intelligence > DNS Lists & Feeds and click update feeds

Objects > Object Management > Security Intelligence > URL Lists & Feeds and click update feeds

Then go to cli and check if the files are downloaded.

You can edit the feeds to change the default update intervals.

HTH

Abheesh

Re: how to get Cisco Security Intelligence feeds

h.dam — Tue, 06 Nov 2018 15:38:21 GMT

hello,

As I mentioned, I don't have internet access. So it failed when I clicked on update feeds.

Re: how to get Cisco Security Intelligence feeds

Marvin Rhoads — Tue, 06 Nov 2018 15:53:33 GMT

As of the current Firepower release (6.2.3.x), Cisco does not support offline downloading of SI feeds for "air gap" deployments like this.

There may be some changes in 6.3; but you will have to wait and see what makes the cut for that release.

Re: how to get Cisco Security Intelligence feeds

Abheesh Kumar — Tue, 06 Nov 2018 15:54:58 GMT

Hi,

SI Feed is comprised of several regularly updated lists of IP addresses that have poor reputations, as determined by the Cisco Talos Security Intelligence and Research Group (Talos). It is important to keep the intelligence feed regularly updated so that a Cisco FireSIGHT System can use up-to-date information in order to filter your network traffic.

Not sure you will get it updated offline and the default update frequency is 30 mins. So if this updates not worked properly or if your SI updates are old and not getting updated from Talos properly then SI will malfunction. So if you would like use SI feature you should be connected to internet.

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/117997-technote-firesight-00.html

HTH

Abheesh

Re: how to get Cisco Security Intelligence feeds

h.dam — Tue, 06 Nov 2018 16:28:02 GMT

Thanks Adheesh for your quick answer.

So, I have to find a solution to get internet access for FMC.

Regards.

Re: how to get Cisco Security Intelligence feeds

wihuang — Thu, 28 Mar 2019 06:13:35 GMT

How about manual download the SI update periodly and then update to the FMC?

Re: how to get Cisco Security Intelligence feeds

Marvin Rhoads — Thu, 28 Mar 2019 09:21:06 GMT

Only Firepower SRU, VDB and GeoDB Content Updates are available for offline download.

SI (IP and DNS lists) feeds can only be ingested directly into FMC.

Re: how to get Cisco Security Intelligence feeds

dvargas@nwfcu.org — Fri, 23 Oct 2020 02:17:21 GMT

Marvin,

Any thoughts on FMC 6.6 ? It appears that the FMC is reaching out to the url via IPv6. However, there isn’t an option to disable IPv6.

Best regards,

Re: how to get Cisco Security Intelligence feeds

Marvin Rhoads — Fri, 23 Oct 2020 11:20:38 GMT

FMC will try to download the feeds and updates via their respective URLs. Cisco (or more accurately the CDN Cisco uses) serves up those URLs via both IPv4 and IPv6 addresses.