Cisco FMC Snort Rule Automatic Downloads

[agilliup]

I've been asked to gather documentation that proves that automatic snort downloads that are scheduled are checked via FMC prior to being downloaded. They are asking to see if the hash is checked prior to installing the new .vrt file into FMC. Can anyone point me to any kind of documentation that can help me?

[Sheraz.Salim]

I tried to look into it on FMC CLI expert> sudo su - then going into cd /var and looking it. I find the

root@fmc:/var
root@fmc:/var/sf/sru# ls -l
total 40
drwxr-xr-x 2 root root 4096 Feb 16 06:21 2022-02-14-001-vrt
drwxr-xr-x 2 root root 4096 Feb 23 06:29 2022-02-22-001-vrt
drwxr-xr-x 2 root root 4096 Mar  2 06:17 2022-02-28-001-vrt
drwxr-xr-x 2 root root 4096 Mar 23 06:29 2022-03-21-001-vrt
drwxr-xr-x 2 root root 4096 Mar 30 05:29 2022-03-28-001-vrt
drwxr-xr-x 2 root root 4096 Apr 13 05:33 2022-04-12-001-vrt
drwxr-xr-x 2 root root 4096 Apr 20 05:33 2022-04-18-001-vrt
drwxr-xr-x 2 root root 4096 Apr 27 05:41 2022-04-25-003-vrt
drwxr-xr-x 2 root root 4096 May  4 05:43 2022-05-02-003-vrt
drwxr-xr-x 2 root root 4096 May 16 22:40 2022-05-10-001-vrt

opening the last vrt Dated May 16 show me this in vi

root@fmc:/var/sf/sru# vi 2022-05-10-001-vrt
" ============================================================================
" Netrw Directory Listing                                        (netrw v149)
"   /var/sf/sru/2022-05-10-001-vrt
"   Sorted by      name
"   Sort sequence: [\/]$,\<core\%(\.\d\+\)\=\>,\.h$,\.c$,\.cpp$,\~\=\*$,*,\.o$,\.obj$,\.info$,\.swp$,\.bak$,\~$
"   Quick Help: <F1>:help  -:go up dir  D:delete  R:rename  s:sort-by  x:exec
" ============================================================================
../
./
Cisco_Firepower_SRU-2022-05-10-001-vrt.sh*
.swo
.swp

but i cant find hasing for the update prior to deploy etc.

[agilliup]

They are looking to find something that verifies the .vrt before downloading it to make sure it's really coming from cisco.