FMC to know if server is running apache or not

[evan.chadwick1]

Hi Folks,

I'm keen to reduce the amount of impact 2 'Apache Struts' remote code execution alerts. I have a couple of questions

1/ should FMC be able to tell if a server is running Apache?

2/ is there a manual setting I can set per server (that is not a IPS supression)

Thanks in advance

[Marvin Rhoads]

If there's a properly configured network discovery and identity policy and the sensor is online for cleartext or decrypted traffic, it should be able to tell.

You can always override with user input or add third party or custom mapping for hosts that you know about:

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/introduction_to_network_discovery_and_identity.html#concept_B9C9F7BF250847D6A4FB888CB738EA17

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/host_identity_sources.html#ID-2219-0000023b

[evan.chadwick1]

Thanks,

This host was populated by discovery. And I also ran Nmap at it.

I guess suppression is my only option?

[Marvin Rhoads]

Overriding the host identity properties that were ascertained by discovery is not the same as suppression of IPS events / IOCs.

I'd go the override route if you know for sure the discovery results are in error.

[evan.chadwick1]

ok, so what your saying here is that:

- if discovery and nmap scan has been successful on an endpoint, and if Firepower treats an endpoint with the struts apache vulnerability (flagging it in the events section), then one can be confident that the endpoint is running Apache. If the endpoint is not running apache then Firepower should not apply the Apache vulnerability, and there will be no 'noise' in the logs about it.

I'm currently asking the server team to confirm a apache on a few devices that regularly get flagged about the struts vulnerability. Its a constant hit, and its just an outside to inside initiated attempt (fairly low importance to be visable to me, as its blocked, and not internal initiated).