Sourcefire application and URL categories lists

[jaime.pedraza]

Hello,

Does anyone know the links to see the list of applications/microapps and categories which are supported by firepower?

Many thanks,

J

[Marvin Rhoads]

It's a dynamic list and I'm not aware that there's any site or page you can just go to to pull it down.

Apps can be seen in Firesight Management Center under Policies > Application detectors. Checking mine just now I see there are 3511 apps/microapps listed.

Similarly you can see the URL categories by editing an Access Control Policy and editing a URL Monitor rule and clicking on the URL tab of the edit dialog box. There you will see all the available categories.

[jaime.pedraza]

Thanks Marvin,

The question is because in many oportunities customers have wanted to see the list before purchasing (comparison porposes mainly), and the CX do have this portal with the additional feature of allowing to request the categorization of new sites.

Regards,

Jaime

[Marvin Rhoads]

That's a good point Jaime - there's a gap between the top level data sheets and the granular dynamic listing you can get from the menu picks in FMC. If you're a partner, you might suggest this via the partner community security forum.

If you don't have an FMC in your lab that you can show to prospective customers, you can use the available Firesight demo on dCloud.

[jaime.pedraza]

Many thanks Marvin, I will do.

[jaime.pedraza]

After dealing with firepower a lot, the I already found the answer: Sourcefire uses the bright cloud database, in other words, the categories and sites categorization are the same as noted on the webpage: www.brightcloud.com. Additionally, if you need to recategorize an URL, just do the procedure stated on this page. It takes usually a couple of work days to complete.

[m1xed0s]

Good to know. It is interesting to see those networking/security vendors to use one shared 3rd party for the URL/IP database. Still wonder why TALOS does not do the URL categorization in-house...

BTW, brightcloud also shows service like "File Reputation", do you know who uses that service on their products?

[Marvin Rhoads]

Actually I have heard the TALOS is looking to pick up the URL categorization in house for FirePOWER. They already handle it for the Cisco Web Security Appliance (WSA).

[tony-smith]

Hi Marvin, Just need to confirm with URL filtering I can only see the categories would it be possible to see a list of sub-categories...I have a client who wants to see sub-categories for example Illegal what are the sites being blocked under this categories...thanks.

[Marvin Rhoads]

There are no sub-categories - just the 80+ top-level categories. I've included a screenshot below (open in new tab to zoom) of how it looks in a URL Filter rule editing session.

I'm not positive if Cisco has integrated / normalized the FirePOWER-categorized URLs with those which you can check on www.senderbase.org. That site will tell you the category (used by the WSA product) if you supply the URL or TLD.

[tony-smith]

Thanks...for you help

[Justin Walker]

This is an old question, but if anyone runs across the post in the future... at this point in time you can view the list on the Sourcefire site here: http://coverage.sourcefire.com/

[Marvin Rhoads]

Thanks, Justin.

I'm not sure that's being kept up to date. I looked there and see 3093 apps (vs. 3511 I got from my FireSIGHT Management Center server earlier this year).

[Kyler Middleton]

And as of March 2017, that link (and in fact, domain!) is now a dead link. 

[jdlee]

you can go here to check if a URL is blocked or not and what category it is in, https://securityhub.cisco.com/web/submit_urls

It's not a bulk list of all categories though.