Cisco Cisco Firepower Management Center 4000 Release Notes
Version 5.2.0.7
Sourcefire 3D System Release Notes
41
Features Introduced in Previous Versions
•
3D6500
•
3D9900
•
DC500/1000/3000
Version 5.2.0.7 of the Sourcefire 3D System can now run on Series 2 appliances.
Previously, Series 2 devices supported only 4.x versions of the Sourcefire 3D
System. Note that Series 2 devices running Version 5.2.0.7 must be managed by
a Defense Center; they no longer have standalone capabilities. For more
information, see the Sourcefire 3D System User Guide.
To update any Series 2 appliance to Version 5.2.0.7 from Version 4.x, you must
To update any Series 2 appliance to Version 5.2.0.7 from Version 4.x, you must
reimage the appliance, which discards all events and configuration data stored on
those appliances. For more information about reimaging, see the Sourcefire 3D
System Installation Guide.
Geolocation
The geolocation feature enhances Sourcefire 3D System analysis tools with data
about the geographical sources of routable IP addresses (the country, continent,
and so on). You can use this data to determine if, for example, connections
originate from or terminate in countries unconnected with your organization.
Geolocation information is available in intrusion events, connection events, file
Geolocation information is available in intrusion events, connection events, file
events, malware events, host profiles, and user profiles. The Context Explorer
and the dashboard can also now include geolocation information.
After you install a geolocation database (GeoDB) update, you can view granular
After you install a geolocation database (GeoDB) update, you can view granular
information available for an IP address, such as postal code, coordinates, time
zone, Autonomous System Number (ASN), internet service provider (ISP), use
type (home or business), organization, domain name, connection type, and proxy
information. Note that the system does not retroactively generate data for events
logged before the update. You can also pinpoint the detected location with any of
four third-party map tools. Note that without a GeoDB update, only the flag icon
and ISO3 alpha country code appear.
Network Discovery
Two new areas of functionality have been added to network discovery for Version
5.2: IPv6 support for network discovery and support for user logoff events
generated by Version 2.1 of the Sourcefire User Agent.
IPv6 Support
Version 5.2 introduces extensive support for IPv6 addresses in features that were
previously limited (partially or completely) to IPv4 addresses. These include
adaptive profiles, auditing compliance, correlation, custom fingerprinting,
FireSIGHT recommendations, host profiles, intrusion events, IP packet
defragmentation, network discovery, the network map, network objects, and the
User Agent.