SMA integration with Threat Response

[AS-NT]

Hello,

I am trying to integrate our SMA with Threat Response. So far the registration succeeded, I generated the token, I can see the device, everything seems to be ok. Unfortunately I can´t do any investigations. I get the error message Client-Timeout in Module SMA. Am I missing some configurations in the firewall? The documentation states that I need port 443 in/out traffic for several FQDNs. Does Cisco initiate a connection from outside to the SMA in out internal network? Is it supposed to work that way??

Regards,

Malte

[Ken Stieers]

If I remember correctly, the SMA builds the connection outbound to the Security Services Exchange. CTR, through the Security Services Exchange queries the SMA for data.

[ppreenja · Accepted solution]

Hello AS-NT,

Please try to reduce the default timeframe to query on CTR from the 30 days (default) to 7 days.

I hope the above helps.

Cheers,
Pratham

[AS-NT]

Great - this worked. Thanks a lot!