Cisco Cisco Firepower Management Center 2000
6
FireSIGHT System Release Notes
New Features and Functionality
The following features and functionality were updated in Version 5.4:
Detection and Security Enhancements
Integrated SSL Decryption
FirePOWER (Series 3) devices can now identify SSL communications and decrypt the traffic before applying attack,
application, and malware detection. You can use SSL decryption in any of the supported Series 3 device deployment
modes, including inline and passive. SSL policies control characteristics of SSL in use within the enterprise, with SSL
rules to exert granular control over encrypted traffic logging and handling.
application, and malware detection. You can use SSL decryption in any of the supported Series 3 device deployment
modes, including inline and passive. SSL policies control characteristics of SSL in use within the enterprise, with SSL
rules to exert granular control over encrypted traffic logging and handling.
Simplified Normalization and Preprocessor Configuration
You now configure traffic normalization and preprocessing in the access control policy, rather than the intrusion policy.
This simplifies configuration, especially for new users. The sensitive data preprocessor, rule states, alerting, and event
thresholds can still be configured at an individual intrusion policy level.
This simplifies configuration, especially for new users. The sensitive data preprocessor, rule states, alerting, and event
thresholds can still be configured at an individual intrusion policy level.
New file_type Keyword in the Snort Rule Language
A new file_type keyword is available in the Snort rules language that enables the specification of a file type for detection.
This is a streamlined alternative to the existing flowbits-driven method.
This is a streamlined alternative to the existing flowbits-driven method.
Expanded IoC support from FireAMP Connectors
The list of Indicators of Compromise (IoC) provided by FireAMP is now dynamic and data-driven. As new IoCs become
available, they are automatically supported by the Defense Center. This enhances the IoC correlation capability in any
deployment where FireAMP is used.
available, they are automatically supported by the Defense Center. This enhances the IoC correlation capability in any
deployment where FireAMP is used.
Protected Rule Content
A new capability of the Snort rule language is available for use in high-security environments. You can now create a Snort
content match using hashed data. This allows the rule writer to specify what content to search for, but never exposes
the content in plain text.
content match using hashed data. This allows the rule writer to specify what content to search for, but never exposes
the content in plain text.
Previously Changed Functionality
The following functionality was introduce in Version 5.4.1.1:
The system now clears all intrusion policy locks when you upload intrusion rules or install intrusion rule updates.
The following functionality was introduced in Version 5.4.1:
Registered ASA devices now have configurable advanced options on the Advanced tab of the Device Management
page (Devices > Device Management).
page (Devices > Device Management).
The show users CLI command is now supported on ASA devices.
You can configure alerts only for retrospective events or network-based malware events from the Advanced Malware
Protections Alerts tab on the Alerts page.
Protections Alerts tab on the Alerts page.
The following features and functionality were updated in Version 5.4:
You can now view VLAN tags for connection events in the event viewer (Analysis > Connections > Events).
The system now identifies login attempts over the FTP, HTTP, and MDNS protocols.
You can now select archived connection events separately from discovery events for transmission to the eStreamer
client.
client.
The Discovery Event Health Monitor is no longer available in health policies.