Cisco Cisco Firepower Management Center 4000

FireSIGHT

If you import data from a third party, you must map the Cisco product to the third-party name to assign 
vulnerabilities and perform impact correlation using that data. Mapping the product associates Cisco 
vulnerability information with the third-party product name, which allows the system to perform impact 
correlation using that data. 

If you import data using the host input import feature, you can also use the AddScanResult function to 
map third-party products to operating system and application vulnerabilities during the import.

As an example, if you import data from a third party that lists Apache Tomcat as an application and you 
know it is version 6 of that product, you could add a third-party map where 

 is set to 

Apache

, 

 is set to 

Tomcat

, 

 is selected from the 

 drop-down list, 

 is selected from 

the 

 drop-down list, and 

 is selected from the 

 drop-down list. That mapping would cause 

any vulnerabilities for Apache Tomcat 6 to be assigned to hosts with an application listing for Apache 
Tomcat. 

Note that for versionless or vendorless applications, you must map vulnerabilities for the application 
types in the system policy. For more information, see 

Note that although many clients have associated vulnerabilities, and clients are used for impact 
assessment, you cannot import and map third-party client vulnerabilities.

If you have already created a third-party mapping on another Defense Center, you can export it and then 
import it onto this Defense Center. You can then edit the imported mapping to suit your needs. For more 
information, see 

Admin

Select 

 

, then click 

.

The User Third-Party Mappings page appears.

You have two choices:

To edit an existing map set, click 

 next to the map set.

To create a new map set, click 

.

The Edit Third-Party Product Mappings page appears. 

Type a name for the mapping set in the 

 field.

Type a description in the 

 field.

You have two choices:

To map a third-party product, click 

To edit an existing third-party product map, click 

 next to the map set. 

The Add Product Map page appears.

Type the vendor string used by the third-party product in the 

 field.