Learn Cisco Sourcefire Firepower Intrusion Prevention System

Block high-risk and non-business web categories with URL filtering in access control policies, using reset or block actions, while managing a 50-category limit and logging to verify blocked traffic.

Create custom application detectors on your farside system to monitor internal apps and apply access rules, using Wireshark packet captures to identify Company X Y Z traffic.

Learn to integrate Active Directory with the Firepower intrusion prevention system by configuring the user agent, AD server, and access-control policy to enforce group-based rules.

Explore how Firesight recommendations analyze hosts to generate and enable intrusion prevention rules, commit and reapply policy updates, and automate scheduling to stay up to date with the latest threats.

Explore locating, cloning, and customizing Cisco's network analysis policies in Firepower, and compare connectivity over security with maximum detection to balance security and connectivity while tuning pre-processing and ports.

Learn how adaptive profiles in the intrusion prevention system defragment packets and reassemble tcap streams like the destination os, enabling anomaly detection and network discovery-driven policy tuning.

Configure dynamic state rules to throttle or drop traffic after threshold matches, applying intrusion policy to block sources during denial of service, demonstrated with icmp echo reply.

Enable rate based attack protection in the network analysis policy, track by source or destination, and drop traffic when thresholds are exceeded to prevent excessive connections and intrusions.

Use the network file trajectory tool to trace file transfers, enabling forensics by showing which machines downloaded the file and when, with sender and receiver IPs and disposition.

Create and monitor traffic profiles in Cisco Firepower to sample data, build a baseline, and alert when activity exceeds normal patterns via standard deviations.

Automate threat response by blocking suspicious traffic with a policy-driven remediation using the map module, correlation events, and block source actions on a Cisco ASA.

Use the set attribute action to tag hosts with unusual traffic, triggering remediation and alerts via policy rules in the Firepower intrusion prevention system.

Learn to use connection tracking in Cisco Sourcefire Firepower IPS to trigger alerts when external initiations target internal hosts, with criteria like country, bytes, time, and host or user identity.

Discover how to use and customize dashboards in Cisco Sourcefire Firepower, adding widgets to monitor traffic, events, risk, and intrusion activity, and build your own custom dashboards.

Context Explorer provides a quick network overview, showing traffic, intrusion events, and top users by source IP and destination IP, with filters for country, security zones, and application protocol.

Learn how perl-compatible regular expressions match payload content in snort rules, with key syntax and modifiers, and how service metadata guides rule application based on identified applications.

Learn to craft snort rules in Firepower to match fragmented IP headers, IP options such as source routing, ICMP values, and flow tracking with content and file inspections.

Explore how transport and network layer preprocessing decodes packets, verifies checksums, and applies inline normalization of headers and payloads for intrusion rules, then manages ECN, TTL, fragmentation, defragmentation, and streams.

Learn clustering and stacking to achieve high availability with active standby, designate a device as active and other as passive, and apply policies to cluster for spillover via ha link.

Configure a virtual router on Sourcefire devices to route traffic between segments, apply security policies and intrusion prevention, and manage layer 3 interfaces, arp entries, static routes, and icmp behavior.

Explore lag interfaces, their types, and how link aggregation control protocol (lacp) negotiates active links, while learning load balancing algorithms, port counts, and policies to optimize redundancy and bandwidth.

Configure Sourcefire vpn gateways using phase one diffie-hellman and phase two sa with rsa authentication to establish encrypted traffic across point-to-point, hub-and-spoke, and mesh deployments.