Cisco Cisco Firepower Management Center 4000

After a day or two, search for events generated by the correlation policy. Analyze the Nmap results for 
the operating systems detected on the hosts to see if there is a particular host configuration on your 
network that the system does not recognize. 

For more information on analyzing Nmap results, see 

If you find hosts with unknown operating systems whose Nmap results are identical, create a custom 
fingerprint for one of those hosts and use it to identify similar hosts in the future. 

For more information, see 

FireSIGHT

When the system detects a new host in a subnet where intrusions may be likely, you may want to scan 
that host to make sure you have accurate vulnerability information for it.

You can accomplish this by creating and activating a correlation policy that detects when a new host 
appears in this subnet, and that launches a remediation that performs an Nmap scan on the host.

After you activate the policy, you can periodically check the remediation status view (

) to see when the remediation launched. The remediation’s dynamic 

scan target should include the IP addresses of the hosts it scanned as a result of the server detection. 
Check the host profile for those hosts to see if there are vulnerabilities that need to be addressed for the 
host, based on the operating system and servers detected by Nmap.

If you have a large or dynamic network, detection of a new host may be too frequent an occurrence to 
respond to using a scan. To prevent resource overload, avoid using Nmap scans as a response to events 
that occur frequently. In addition, note that using Nmap to challenge new hosts for operating system and 
server information deactivates Cisco monitoring of that data for scanned hosts. 

Admin/Discovery Admin

Configure a scan instance for an Nmap module. 

For more information, see 

Create an Nmap remediation using the following settings:

Enable 

 to scan the port associated with the new server.

Enable 

to detect operating system information for the host.

Enable 

 to detect server vendor and version 

information.

Enable 

, because you know the host exists.

For information on creating Nmap remediations, see 

.

Create a correlation rule that triggers when the system detects a new host on a specific subnet.

The rule should trigger when 

 and 

.

For information on creating correlation rules, see 

Create a correlation policy that contains the correlation rule.