About EverythingBagel62093

EverythingBagel62093 · 07-22-2021

We are switching over a section of our environment from McAfee Network Security to Firepower. We have several different policies for different customers. McAfee uses a combination of NSP rules, CVEs, and other ways to identify and categorize intrusti...

EverythingBagel62093 · 04-21-2021

Hi, Using an FMC. I turned on SNMP alerts for Intrusion Impact Alerts. Traps came through, but it's not showing all of the relevant OIDs that are possible given the Enterprise number. How can I enrich the SNMP traps coming from the FMC to show more o...

EverythingBagel62093 · 04-20-2021

Hi everyone, We have an FMC set up that is managing a number of FTD devices. We currently have alerts set up to send emails when intrusion events occur. Emails are generated using the Impact Flag settings and when specific rules are fired (via the In...

EverythingBagel62093 · 10-27-2020

I uploaded the ISO to a SCP enabled server. When attempting to re-image the Firepower Device (8130), I put in the IP address, authorized user name for the SCP server, full path to the ISO image directory (/home/username), and password for the usernam...

EverythingBagel62093 · 10-24-2020

Let's say that I have a few Sourcefire 3D Sensors (8130) and a Sourcefire Management Center that are on an OS that is before 5.4, one of them being on a version that's a bit older. What are the suggested upgrade paths for these devices? I know that I...

EverythingBagel62093 · 08-03-2021

Hi Marius, Would the method of exporting the rule-set be along the lines of using the API and GET /policy/intrusion/{parentId}/intrusionrules? I'm pretty new to this, so apologies if I'm asking something with an obvious answer. Thank you.

EverythingBagel62093 · 07-29-2021

Hi Marvin,Thanks for that, but that would be more for looking up rules one at a time. I'm looking for something that we could use to look up rules via CVE or McAfee ID by the hundreds/thousands.

EverythingBagel62093 · 07-29-2021

Hi, Are there any guidance documents on how to search for CVEs or McAfee ID (since that is something that can be filtered for in the intrusion ruleset in the policy) and enabling/disabling them? That would be a huge help. We absolutely plan on using ...

EverythingBagel62093 · 04-20-2021

OK, looking through the documentation, would it be accurate to say that the MIB would assist in translating the SNMP traps?

EverythingBagel62093 · 10-27-2020

Is the only way to load the ISO into the device for re-imaging really via downloading from a http/ftp/scp server?

Member Since	‎10-22-2020 10:07 AM
Date Last Visited	‎08-08-2021 10:45 AM
Posts	13

User Statistics

User Activity

Switching over to Firepower from McAfee Network Security - McAfee rules to Snort

SNMP Trap not showing all OID

Intrusion Alert - Email vs SNMP

Re-imaging Firepower Device - Can't find ISO in Interactive Menu

Suggested upgrade path for older Sourcefire devices/manager

Re: Switching over to Firepower from McAfee Network Security - McAfee

Re: Switching over to Firepower from McAfee Network Security - McAfee

Re: Switching over to Firepower from McAfee Network Security - McAfee

Re: Intrusion Alert - Email vs SNMP

Re: Re-imaging Firepower Device - Can't find ISO in Interactive Menu