Stop receiving Apache Malware Outside to Inside Events when inside server does not run Apache

[evan.chadwick1]

Hi Folks, 

I have an internal server that does not run Apache, it can be reached from external via port 80/443.

I get a malware event alerts for dropped traffic from Outside to Inside for an inside server that does not have Apache installed. I thought that Firepower trimmed such alerts out for end hosts that do not have certain software installed?

To reduce such alerts for things that are not installed on a host, should I create host profiles for servers that only run a few things and strictly tell Firepower what I care about rather than rely upon what Firepower has determined itself?

[mikael.lahtela]

Hi,

Is this a File event, SI event or IPS event?
If IPS do you run the Firepower recommended settings in IPS in scheduled or manual updates?
Is the server host profile correct in FMC?

br, Micke

[evan.chadwick1]

It was an IPS event. 

I manually set the OS to force it.

I run FP recommendations and refresh them weekly.