Cisco Cisco FirePOWER Appliance 8390
41-5
FireSIGHT System User Guide
Chapter 41 Configuring Remediations
Creating Remediations
•
•
•
Cisco IOS Block Destination Remediations
License:
FireSIGHT
The Cisco IOS Block Destination remediation allows you to block traffic sent from the router to the
destination host in a correlation event.
destination host in a correlation event.
Note
Do not use this remediation as a response to a correlation rule that is based on a discovery event;
discovery events only transmit a source host and not a destination host. You can use this remediation in
response to correlation rules that are based on connection events or intrusion events.
discovery events only transmit a source host and not a destination host. You can use this remediation in
response to correlation rules that are based on connection events or intrusion events.
To add the remediation:
Access:
Admin/Discovery Admin
Step 1
Select
Policies > Actions > Instances
.
The Instances page appears.
Step 2
Next to the instance where you want to add the remediation, click the view icon (
).
If you have not yet added an instance, see
.
The Edit Instance page appears.
Step 3
In the
Configured Remediations
section, select
Block Destination
and click
Add
.
The Edit Remediation page appears.
Step 4
In the
Remediation Name
field, enter a name for the remediation.
The name you choose cannot contain spaces or special characters and should be descriptive. For
example, if you have multiple Cisco IOS router instances and multiple remediations for each instance,
you may want to specify a name such as
example, if you have multiple Cisco IOS router instances and multiple remediations for each instance,
you may want to specify a name such as
IOS_01_BlockDest
.
Step 5
Optionally, in the
Description
field, enter a description of the remediation.
Step 6
Click
Create
, then click
Done
.
The remediation is added.
Cisco IOS Block Destination Network Remediations
License:
FireSIGHT
The Cisco IOS Block Destination Network remediation allows you to block any traffic sent from the
router to the network of the destination host in a correlation event.
router to the network of the destination host in a correlation event.