Firepower Recommendations

[marcio.tormente]

Hello folks,

I would like to ask if someone knows about Firepower Recommendations.

Is this recommendations is based on what (host profiles, connection events, malware events, Discovery events)?

How long they have to keep the all infomations to generate relaible recommendations?

Thanks

[Collin Clark]

I typically let Sourcefire run in monitor mode for 10-14 days before running 'recommendations'.

HTH