Cisco Cisco Firepower Management Center 4000

A FireSIGHT System appliance is either a traffic-sensing managed device or a managing Defense 
Center. Both Defense Centers and their managed devices can be deployed as purpose-built network 
appliances provided by Cisco; you can also deploy software-based appliances.

A Defense Center provides a centralized management point and event database for your FireSIGHT 
System deployment. Defense Centers aggregate and correlate intrusion, file, malware, discovery, 
connection, and performance data, assessing the impact of events on particular hosts and tagging hosts 
with indications of compromise. This allows you to monitor the information that your devices report in 
relation to one another, and to assess and control the overall activity that occurs on your network.

Key features of the Defense Center include:

device, license, and policy management

event and contextual information displayed in tables, graphs, and charts

health and performance monitoring

external notification and alerting

correlation, indications of compromise, and remediation features for real-time threat response

custom and template-based reporting

For many physical Defense Centers, a high availability (redundancy) feature can help you ensure 
continuity of operations.

Devices deployed on network segments within your organization monitor traffic for analysis. Devices 
deployed passively help you gain insight into your network traffic. Deployed inline, you can use 
FirePOWER devices to affect the flow of traffic based on multiple criteria. Depending on model and 
license, devices:

gather detailed information about your organization’s hosts, operating systems, applications, users, 
files, networks, and vulnerabilities

block or allow network traffic based on various network-based criteria, as well as other criteria 
including applications, users, URLs, IP address reputations, and the results of intrusion or malware 
inspections

have switching, routing, DHCP, NAT, and VPN capabilities, as well as configurable bypass 
interfaces, fast-path rules, and strict TCP enforcement

have clustering (redundancy) to help you ensure continuity of operations, and stacking to combine 
resources from multiple devices

You must manage FirePOWER devices with a Defense Center.

The FireSIGHT System can run on fault-tolerant, purpose-built physical network appliances available 
from Cisco. There are several models of each Defense Center and managed device; these models are 
further grouped into series and family.

Physical managed devices come in a range of throughputs and have a range of capabilities. Physical 
Defense Centers also have a range of device management, event storage, and host and user monitoring 
capabilities.