firesight

The video shows you how to perform system backup and restore on Cisco FireSight System and its managed devices. We will perform an on-demand manual backup, and well as showing you configuration for regular scheduled backup. We will then validate our backup by performing a restore and make sure all configurations are reverted back to the backup point.

The video shows you how to leverage an existing Active Directory database for administrative user login on Cisco ASA FireSight System. We will go through configuration of LDAP integration, and usergroup-to-role mapping. You will be able to limit access to FireSight web interface based on your user job function.

The video demonstrates capability of Cisco ASA FirePower to detect anomalous traffic pattern. We will be configuring the FireSight System to monitor HTTP traffic to our servers, create traffic profile, and have it generate alert upon significant traffic pattern deviation. A HTTP packet generation tool will be used to generate HTTP requests at different rate to test our traffic profile.

The video demonstrates Cisco ASA FirePower capability to correlate system events and generate appropriate remediation responses. We will go through two example scenarios; one with a basic event matching and responding, and the other continues to track the connection and apply a more complex conditions before issuing response. Specifically, we will configure NMAP scan and IP shun remediations. 

The video demonstrates Cisco ASA FirePower capability to correlate system events and generate appropriate remediation responses. We will go through two example scenarios; one with a basic event matching and responding, and the other continues to track the connection and apply a more complex conditions before issuing response. Specifically, we will configure NMAP scan and IP shun remediations. 

The video demonstrates the use of Whitelist feature on Cisco ASA FirePower to enforce application compliancy on end-host. We will look at two ways of creating a host profile; manual and from host discovery, and apply them to a network to have the FireSight System monitor and generate alert when any unapproved network protocols or application services are detected.

The video shows you how to create a custom intrusion rule on Cisco ASA FirePower. We will generate a special HTTP request to simulate malicious traffic and build an intrusion rule to match the content of the request and drop it. You will learn available parameters that you can use on FireSight web interface Rule Editor to define attack signature.

The video takes you deeper into Intrusion Policy configuration on Cisco ASA FirePower as we use Policy Layer and FireSight Recommendation. Policy Layer provides configuration flexibility, while FireSight Recommendation assist you in determining appropriate intrusion rules to enable or disable. We will also test our configuration by simulating attacks using Metasploit vulnerability testing tool. The video will close by showing you how to setup intrusion event alert and manage intrusion incidents.

The video takes you deeper into Intrusion Policy configuration on Cisco ASA FirePower as we use Policy Layer and FireSight Recommendation. Policy Layer provides configuration flexibility, while FireSight Recommendation assist you in determining appropriate intrusion rules to enable or disable. We will also test our configuration by simulating attacks using Metasploit vulnerability testing tool. The video will close by showing you how to setup intrusion event alert and manage intrusion incidents.

The video walks you through basic configuration of Intrusion Policy on Cisco ASA FirePower. We begin by explaining significance of the use of Variable Set, the concept of Base Policy, and various settings in an Intrusion Rule. We will adjust some of an Intrusion Rule settings including, Threshold, Suppression, and Dynamic State, and observe how they effect the rule behavior using ICMP Reply Undefined Code rule as our example.