Cisco Cisco Firepower Management Center 4000

Series 3, Virtual, X-Series, ASA FirePOWER

Any except DC500

While editing an access control policy, you can create an object on-the-fly to use in its whitelist and 
blacklist: either a network object or a Security Intelligence list or feed. Note that to group network 
objects or create network object groups, you must use the object manager.

Admin/Access Admin/Network Admin

Click the add icon (

), then select the type of object you want to create:

Select 

 to create a Security Intelligence list or feed; see 

Select 

 to add a network object; see 

.

Protection

Series 3, Virtual, X-Series, ASA FirePOWER

Any except DC500

Logging blacklisted connections allows you to generate a connection event when the system detects 
network traffic to or from a blacklisted IP address. You can save these connection events to the Defense 
Center database, and can also log the events to the syslog or to an SNMP trap server using alert 
responses. For information on setting up alert responses, see 

.

You must send events to the Defense Center if you want to set blacklisted objects to monitor-only, or 
perform any other Defense Center-based analysis on connection events generated by Security 
Intelligence filtering.

Unlike the logging options for access control rules or the default action, you cannot choose whether to 
generate beginning- or end-of-connection events. Events generated by Security Intelligence filtering 
always represent the beginning of a connection and the decision made by the system to either:

deny the traffic without further inspection (blacklist)

perform further analysis on the connection (blacklist set to monitor-only)

This decision is logged as a connection event’s reason: either 

IP Block

 or 

IP Monitor

. The decision is 

also reflected in the connection event’s action, which for a blacklisted connection is 

Block

. Contrast with 

a monitored connection, where the action is that of the first non-Monitor access control rule triggered 
by the connection, or the default action. 

The system also logs a Security Intelligence category, which qualifies the reason the connection was 
blacklisted. Connection events with an associated Security Intelligence category also appear in Security 
Intelligence event views (

), allowing you to analyze 

Security Intelligence connection data more easily. For more information on connection and Security 
Intelligence events, see 

.

In the event viewer, so that you can identify the blacklisted IP address in the connection, host icons next 
to blacklisted and monitored IP addresses look slightly different.