Cisco Cisco Firepower Management Center 4000

In the special case of detecting sensitive data in FTP traffic, specifying the 

FTP data

 application 

protocol does not invoke detection; instead, it invokes the rapid processing of the FTP/Telnet 
processor to detect sensitive data in FTP traffic. See 

 

for more information.

Ensure that the FTP Data detector, which is enabled by default, is enabled. 

See 

.

Ensure that your configuration includes at least one port to monitor for sensitive data. 

Note that it is not necessary to specify an FTP port except in the unlikely case where you only want 
to detect sensitive data in FTP traffic. Most sensitive data configurations will include other ports 
such as HTTP or email ports. In the case where you do want to specify only one FTP port and no 
other ports to monitor, Cisco recommends that you specify the FTP command port 

23

. See 

 or more information.

Protection

You can create and modify custom data types to detect data patterns that you specify. For example, a 
hospital might create a data type to protect patient numbers, or a university might create a data type to 
detect student numbers that have a unique numbering pattern.

Each custom date type you create also creates a single sensitive data preprocessor rule that has a 
generator ID (GID) of 138 and a Snort ID of 1000000 or greater, that is, a SID for a local rule. You must 
enable the associated sensitive data rule to enable detection, and event generation, for each custom data 
type you want to use in your policy. See 

 for information on enabling 

rules in an intrusion policy.

To help you enable sensitive data rules, a link on the configuration page takes you to a filtered view of 
the Rules page that displays all predefined and custom sensitive data rules. You can also display only 
custom sensitive data rules by selecting the local rule filtering category on the Rules page. See 

 for more information. Note that custom sensitive data rules are 

not listed on the Rule Editor page.

Custom data types you create are added to all intrusion policies. You must enable the associated sensitive 
data rule in any policy that you want to use to detect and generate events for a particular custom data 
type.

Note that you must use the Sensitive Data Detection configuration page to create data types and their 
associated rules. You cannot use the rule editor to create sensitive data rules.

See the following sections for more information:

Protection

You define the data pattern for a custom data type using a simple set of regular expressions comprised 
of the following:

three metacharacters