Possible to send IoC events from FMC to SNMP/Email?

[Chess Norris]

Hello,

We are running FMC 7.2 and on the summery dashboard on the Threats TAB, there is a list called  "Indication of Compromise by Host" where we can see hosts that have downloaded malware and are CnC connected. It looks like this:

We would like to get an email or/and a SNMP alert whenever this happens, but I cannot find where I can configure this. 

I've looked under Policys->Actions->Alerts->Advanced Malware Protection Alerts, but I am not sure this is exactly the same alerts? 

Thanks

/Chess

[Chess Norris]

Did some more invistagation into this and the IoC events we see in the Threat TAB in the dashboard comes from the Analysis->Hosts->Indications of Compromise page.  Is it possible to get emaill alerts for those events?

Thanks

/Chess

[Marius Gunnerud]

You could look into Monitor Alerts, there you can create alerts for Security intelligence on the FMC.

Another option, and perhaps a better option, is to integrate your FMC with SecureX, there you should be able to create playbooks based on events and those events trigger actions like sending an email.

https://www.cisco.com/c/en/us/td/docs/security/firepower/integrations/SecureX/secure_firewall_management_center_and_securex_integration_guide/introduction_about_the_integration.html

https://blogs.cisco.com/security/automate-your-way-to-success-with-cisco-securex

[Chess Norris]

Thanks Marius. I will have a look at that.

Edit. Is this the correct one? This was the only one I found related to Security Intelligence, but it seems more like an update alert?

Best regards

/Chess

[rgeelen]

Same question here. IoC is an interesting event to receive in both mail alert and SNMP trap from FMC.
However I also feel the need to differentiate on type of IoC: 

Outside in: blocked and happens all the time: not that much interested in 
Inside out: that looks like we have a host with a CnC infection: very interesting to know and investigate further
Inside to inside host: same as above. 

I am starting to test with a rule under Policies - Correlation - Rule Management and use as connections event with an IOC Tag for certain networks. After that under Policy Management connect new Rule to the SNMP settings to that rule. Hope that works as expected. 

Cheers /Ruud