Can FireSight blacklist an IP after it identifies malware from them

[paul-d]

Hi,

We have FirePower managed by FireSight, and i was wondering, can you get FireSight to blacklist an IP when it say identifies the sender as emailing malware? 

Or set an IPS policy to blacklist the source IP address when a malware event is triggered,  for a period of say 24 hours?

Thank You

Chris

[Marvin Rhoads · Accepted solution]

Yes - you use Correlation Policy with rules and remediations for this.

The logic of doing it is a bit complex (in my opinion) but you can watch the excellent labminutes video on this topic to learn how.

http://www.labminutes.com/sec0177_asa_firepower_event_correlation_remediation_1