How Can I Add Custom Indicator Of Compromise (IOC) In Firepower 2140?

[ict.helpdesk]

Dear Geeks,

In order to detect / prevent security threats with custom IOC (provided by our vendors for threat intelligences), how I can be able to add custom IOCs in our firepower 2140 with threat defense license? I cannot find any useful supports and cisco support documents. Could you please help me guide how I can accomplish this?

Thanks for all of your kind supports.

Best Regards,

Wai Yan 

[Marvin Rhoads]

You would do that via ingesting the third party feeds via TAXII. It does require Firepower Management Center 6.2.2 or later.

More details are as described here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/cisco_threat_intelligence_director__tid_.html

[ict.helpdesk]

Thanks for your kind response. Our FMC version is 6.2.3 and hope it would be fine. I will follow the link and will proceed accordingly.

Best Regards,

Wai Yan Phyo