Security Intelligence (SI) on FDM managed devices.

[5010]

Hi all,

In FMC, both IPS and Security Intelligence (SI) can be deployed in a detection/monitor-only mode for tuning and false-positive validation before enabling blocking.

In FDM, I can only find a Detection mode option for IPS. SI appears to be block-only with no monitor mode.

what is the general recommendation for safely deploying and tuning SI on FDM-managed FTD devices?

Thanks.

[Aref Alsouqi]

If you configure detection on your policy you will be good to go because in that case the FTD will detect any potential intrusion event but it won't be blocking any traffic. Once you are happy with the detections you can then go and switch from detection to prevention.

[jamiewalls02]

FDM does not provide a monitor-only mode for Security Intelligence like FMC does. A common approach is to start with a limited, high-confidence SI policy, monitor connection events and logs closely, and gradually expand the block lists as Engage PEO login you validate there are no false positives. Testing in a non-production environment first, where possible, is also recommended.