SEC0390 - Firepower 7.0 Event Correlation and Remediation (Part 2)

The video demonstrates capabilities to correlate system events and generate appropriate remediation responses on Cisco Firepower 7.0. We will go through three sample scenarios; first with a basic event matching and responding, second with connection tracking, and third using Malware event. The responses that will be configured are NMAP scan, ISE ANC and SGT assignment

Part 2 of this video covers the second scenario to quarantine user that transfer a file larger than 1MB via FTP using ISE ANC

Topic:

• Correlation Policy and Rules
• Correlation Rule Event Conditions
• Connection Tracking
• Remediation Response and Response Group
• Remediation with NMAP Scan, ISE ANC, and SGT
• ISE Integration