Cisco Cisco Firepower Management Center 4000

Internal detectors are always on; you cannot deactivate, delete, or otherwise configure them. 
Examples of internal detectors are the Built-in Amazon detector and the Built-in AppleTalk detector.

Cisco-provided client detectors, which detect client traffic, are delivered via VDB updates but may 
also be provided with updates to the FireSIGHT System. These detectors may also be provided by 
Cisco Professional Services as an importable detector.

You can activate and deactivate client detectors according to the needs of your organization. VDB 
updates may also activate or deactivate client detectors. You can export a client detector only if you 
import it.

The Google Earth and Immunet detectors are examples of client detectors.

Cisco-provided web application detectors, which detect web applications in payloads of HTTP 
traffic, are delivered via VDB updates but may also be provided with updates to the FireSIGHT 
System.

You can activate and deactivate web application detectors according to the needs of your 
organization. VDB updates may activate or deactivate web application detectors. Examples of web 
application detectors are the Blackboard and LiveJournal detectors.

Port-based application protocol detectors, provided by Cisco, are based on detection of network 
traffic on well-known ports. These detectors are delivered via VDB updates but may also be 
provided with updates to the FireSIGHT System or provided by Cisco Professional Services as an 
importable detector. 

You can activate and deactivate application protocol detectors according to the needs of your 
organization. You can also view a detector definition to use it as the basis for a custom detector. VDB 
updates may activate or deactivate application protocol detectors.

The chargen and finger detectors are examples of port detectors. 

FireSIGHT-based application protocol detectors, provided by Cisco, are based on detection of 
network traffic using FireSIGHT application fingerprints. These detectors are delivered via VDB 
updates but may also be provided with updates to the FireSIGHT System. 

You can activate and deactivate application protocol detectors according to the needs of your 
organization. VDB updates may activate or deactivate Cisco-provided application protocol 
detectors. Examples of FireSIGHT-based application protocol detectors are the Jabber and Steam 
detectors.

Pattern-based application detectors are based on detection of patterns in packets from network 
traffic. These detectors can be provided by Cisco Professional Services as an importable detector or 
created by you. This allows you to enhance the system’s detection capabilities with new 
pattern-based detectors without updating the FireSIGHT System as a whole.

You can activate and deactivate application protocol detectors according to the needs of your 
organization.