Attack Risk & Netwoork risk Report FMC

[faruqfarkhan]

Dear ALL,
I want to ask about the cisco FMC report, I'm a little confused in some parts.

Is the result of this report the result of monitoring the work of the FMC device? I mean is this attacker's IP automatically blocked? do I have to add a layer 3/4 rule for further processing?

Then for network risk, does anyone have experience regarding what actions I can take based on the results of the network risk report?

Thanks,

[Marvin Rhoads]

These reports are more useful as starting points and/or marketing fodder for Cisco to alert you to look into what your devices are configured to do. The reporting in itself does not tell you what your policies do (or don't do). You could have everything running in IDS mode (detect-only) and get the same report as you would when running in IPS (prevention) mode.