Possible to send IoC events from FMC to SNMP/Email?

[Chess Norris]

Hello,

We are running FMC 7.2 and on the summery dashboard on the Threats TAB, there is a list called  "Indication of Compromise by Host" where we can see hosts that have downloaded malware and are CnC connected. It looks like this:

We would like to get an email or/and a SNMP alert whenever this happens, but I cannot find where I can configure this. 

I've looked under Policys->Actions->Alerts->Advanced Malware Protection Alerts, but I am not sure this is exactly the same alerts? 

Thanks

/Chess

[Chess Norris]

Did some more invistagation into this and the IoC events we see in the Threat TAB in the dashboard comes from the Analysis->Hosts->Indications of Compromise page.  Is it possible to get emaill alerts for those events?

Thanks

/Chess

[Marius Gunnerud]

You could look into Monitor Alerts, there you can create alerts for Security intelligence on the FMC.

Another option, and perhaps a better option, is to integrate your FMC with SecureX, there you should be able to create playbooks based on events and those events trigger actions like sending an email.

https://www.cisco.com/c/en/us/td/docs/security/firepower/integrations/SecureX/secure_firewall_management_center_and_securex_integration_guide/introduction_about_the_integration.html

https://blogs.cisco.com/security/automate-your-way-to-success-with-cisco-securex

[Chess Norris]

Thanks Marius. I will have a look at that.

Edit. Is this the correct one? This was the only one I found related to Security Intelligence, but it seems more like an update alert?

Best regards

/Chess