Cisco Cisco FirePOWER Appliance 7115

Version 5.3

Sourcefire 3D System User Guide

1256

Working with Malware Protection and File Control

Working with Sourcefire Cloud Connections for FireAMP

Chapter 31

2. Click Create FireAMP Connection.

The Create FireAMP Connection dialog box appears.

3. Select the Cloud Name for the cloud you want to use, then click Register.
4. Confirm that you want to continue to the FireAMP portal, then log into the 

portal.
The Applications page on the portal appears. Use this page to authorize the 

Sourcefire cloud to send malware events to the Defense Center.

5. Optionally, select specific groups within your organization for which you want 

to receive malware events.
Select groups only if you want to restrict the events you receive. By default, 

the Defense Center receives malware events for all groups. 

To manage groups, select Management > Groups on the FireAMP portal. 

For detailed information, refer to the online help on the portal. 

6. Click Allow.

You are returned to the FireAMP Management page on the Defense Center. 

Your connection is enabled and the Defense Center begins receiving malware 

events from the cloud.
Clicking Deny also returns you to the Defense Center, where the cloud 

connection is marked as denied. Similarly, if you navigate away from the 

Applications page on the FireAMP portal, and neither deny nor allow the 

connection, the connection is marked as pending on the Defense Center’s 

web interface. The health monitor does not alert in either of these situations. 

If you want to connect to the cloud later, you must delete the failed or 

pending connection, then recreate it.

Deleting or Disabling a Sourcefire Cloud Connection

: Any

Delete a Sourcefire cloud connection if you no longer want to receive malware 

events from the cloud. To temporarily stop malware events from being sent for a 

particular connection, you can disable the connection rather than deleting it. In