Hosts - Indications of compromise

[Lee Dress]

My firepower reports that there are indications of compromise on a few computers every day.

when i drill into the analysis, the malware event was blocked (with reset) with my policy.  So the devices have not really been compromised.

is there some way to setup the policy that it doesn't tell me these devices have been compromised?

I spend quite a bit of time clearing this out now because they are jut "hits" to a malware site, and not an actual connection or file download.

[Rahul Govindan]

What are the event types that are being detected? You can enable and disable specific IOC detection rules under Policy > Network Discovery > Advanced > Edit IOC settings

For example you can disable the rule to detect hosts flagged by malware-cnc event as IOC host. also, there does not seem to be a way to edit or add new rules for IOC detection.

[Lee Dress]

I am getting CNC connected, but the connection is blocked when i drill into the analysis

I'm also getting URL Malware which is also blocked.

so you're saying it's safe to turn these off in IOC, and the rule will still protect the devices?

[Rahul Govindan]

Your file or URL is blocked by the URL filtering or AMP engine policy. IOC detection just uses data from these engines to detect an IOC. The block action should be taken by the individual Engines themselves.

[Chekol Retta]

Hi Lee

I got a few CnC connected but couldn't see the action taken against them

Where do you see the CnC connected is blocked after drilling into analysis? 

[mjkvern@lrhc.org]

I am also seeing CnC Connected. Under Analysis>Hosts>Indications of Compromise  We have several listed here including my own ip address. I try to drill down what I have installed or the issue is that these are reporting as an indication, but i cant seem to find any information. 

Does anyone have any insight as to how to read these in order to correct the issue? Description only says "This host may be under remote control" with no other information. I want to know How? and how to fix it.