Cisco Cisco Firepower Management Center 4000

The Advanced Settings page appears.

You have two choices, depending on whether 

under Specific Threat Detection is 

enabled:

If the configuration is enabled, click 

.

If the configuration is disabled, click 

, then click 

.

The Portscan Detection page appears. A message at the bottom of the page identifies the intrusion 
policy layer that contains the configuration. See 

 for 

more information.

In the 

 field, specify which of the following protocols you want to enable:

TCP

UDP

ICMP

IP

Use Ctrl or Shift while clicking to select multiple protocols or clear individual protocols. See the 

 table for more information.

Note that you must ensure that TCP stream processing is enabled to detect scans over TCP, and that UDP 
stream processing is enabled to detect scans over UDP. 

In the 

 field, specify which of the following portscans you want to detect:

Portscan Detection 

Port Sweep

Decoy Portscan

Distributed Portscan

Use Ctrl or Shift while clicking to select or deselect multiple protocols. See the 

 table for 

more information.

In the 

 list, select the level you want to use: low, medium, or high.

See the 

 table for more information.

Optionally, in the 

 field, specify which host you want to watch for signs of portscan activity, or 

leave the field blank to watch all network traffic.

You can specify a single IP address or address block, or a comma-separated lists of either or both. For 
information on using IPv4 and IPv6 address blocks in the FireSIGHT System, see 

.

Optionally, in the 

 field, specify which hosts you want to ignore as scanners. Use this field 

to indicate hosts on your network that are especially active. You may need to modify this list of hosts 
over time.

You can specify a single IP address or address block, or a comma-separated lists of either or both. For 
information on using IPv4 and IPv6 address blocks in the FireSIGHT System, see 

.

Optionally, in the 

 field, specify which hosts you want to ignore as the target of a scan. Use 

this field to indicate hosts on your network that are especially active. You may need to modify this list 
of hosts over time.

You can specify a single IP address or address block, or a comma-separated lists of either or both. For 
information on using IPv4 and IPv6 address blocks in the FireSIGHT System, see 

.