How to get a Connection Matrix out of the FireSight?

[HELMUT DACHS]

Hi All,

did someone have a useful hint how i can get a usefull connection matrix out of the FireSight Management to create a Ruleset for the ASA, which is at the moment on pemit any .... Focus should be a list of source and destination IP with port and maybe a counter - did some investigation on the connection events - but it is too much information and too much same events - and i have only events from the last 2 days ... i would like to get the result maybe from one or two weeks - is there a way to do this?

Thank You in advance

Helmut

[atatistc · Accepted solution]

You can generate reports based on connection events and connection workflows.  You could create a custom workflow with something like Initiator IP, Responder, IP, dst port, count.  That would give you the count of connections between a src/dst IP on a given dst port.  

As for connection history that's a tough one depending on the amount of traffic going through your device.  The default connection limit is 1M connections.  You can raise that in the System Policy database setting but be careful as bumping this up too high can cause it to take a long time to process connection event queries.  A week is really all we can ever hope for and even that is often too long (too many connections).

[HELMUT DACHS]

Thank You - Thats working great - right in the way i need !!!