How to confirm that certain CVE# is included in specific SRU for IPS (1500 FMC and 8250 Sensors)?

[Mahmoud Shawky]

We have many CVE numbers and we need to make sure that our IPS is aware of them and we are protected against them. Whenever we search by the CVE# from the FMC GUI, it shows nothing as the CVE# is included explicitly in the details not the main info.

So, can anyone has an idea where to achieve this?

[Marvin Rhoads · Accepted solution]

It can be easily done as follows:

Policies > Access control > Intrusion, edit your Intrusion Policy.

Select Rules > Rule Content > Reference. Expand the section and select CVE ID. Enter the ID you are interested in and it will show you the rules that address the CVE in question.

FMC CVE Search

[Mahmoud Shawky]

Thanks for the reply, however i have certain CVE numbers which i could not find even if it's with an old date 2019!

Does this imply that our IPS is not aware of and accordingly we're not protected against it?!!

[Marvin Rhoads]

Not every CVE in existence requires an IPS rule. It's based on the vulnerability and exposure being network-related and thus something the NGFW/NGIPS can act upon.

If there's a specific CVE or set of CVEs that you believe meet this criteria but are not included, I'd suggest opening a TAC case. They can assign it to the TALOS group for investigation.