topic Re: Detecting Malware and Suspicious activity in Network Security

Detecting Malware and Suspicious activity

dan hale — Fri, 21 Feb 2020 16:00:11 GMT

Hi All, I have a 2120 running in FTD mode with the IPS and AMP licenses and an FMC all on version 6.2. I setup the IPS and AMP (file policy) based on the configuration guide.

On my Access Control Policy I do have both the file policy and IDS checked to inspect when internal traffic goes out to the internet.

There are some weird connection events that lead me to believe some internal hosts maybe compromised when I look in the connection events...some computers talking to other countries that should not.

Besides setting up Geofencing to deny internal traffic to those countries is there a better report I can run besides looking at the connection events?

Thanks,

Dan.

Re: Detecting Malware and Suspicious activity

yogdhanu — Tue, 24 Jul 2018 12:44:22 GMT

You can also enable security intelligence (both URL and IP) and make sure the default blacklist categories are blocked. That also does the trick sometime.

Hope it helps,

Yogesh

Re: Detecting Malware and Suspicious activity

dan hale — Wed, 25 Jul 2018 16:11:52 GMT

Thanks Yogesh I already have SI enabled.

Thanks,

Dan

Re: Detecting Malware and Suspicious activity

mikael.lahtela — Wed, 15 Aug 2018 22:36:57 GMT

If you have access to Cisco Live, checkout "A Deep Dive into using the Firepower Manager - BRKSEC-2058".
Very helpful tips on how to manage Firepower.

br, Mikael