Firesight IPS Policy Creation

[QUARK TARO]

I need help with asa firesight ips rule creation.

By default there is "Network Discovery" under access control. This is working fine, I can see the connection events.

Now I want to make it full fledged IPS. How do I do that?

On Firesight, IPS -> Policy, create a new policy, here do I need to defines, rules and categories?

[Marvin Rhoads · Accepted solution]

Please review the Cisco Live presentation for session BRKSEC-2018 from Cisco Live US earlier this year. It is a free download from ciscolive365.com.

It does a great job at laying out what policies are required for an effective FirePOWER deployment and how to create them.

[yogdhanu]

You can either create a new IPS policy or use default policies. You need to select an IPS policy in the access control rule which is turn will apply the policy.