Cisco Cisco FirePOWER Appliance 7020
42-35
FireSIGHT System User Guide
Chapter 42 Enhancing Network Discovery
Importing Host Input Data
After you create a custom product mapping, you must activate the custom product mapping list. After
you activate a list of custom product mappings, the system updates all servers with occurrences of the
specified vendor strings. For data imported through the host input feature, vulnerabilities update unless
you have already explicitly set the product mappings for this server.
you activate a list of custom product mappings, the system updates all servers with occurrences of the
specified vendor strings. For data imported through the host input feature, vulnerabilities update unless
you have already explicitly set the product mappings for this server.
If, for example, your company modifies the banner for your Apache Tomcat web servers to read
Internal Web Server
, you can map the vendor string
Internal Web Server
to the vendor
Apache
and
the product
Tomcat
, then activate the list containing that mapping, all hosts where a server labelled
Internal Web Server
occurs have the vulnerabilities for Apache Tomcat in the database.
Tip
You can use this feature to map vulnerabilities to local intrusion rules by mapping the SID for the rule
to another vulnerability.
to another vulnerability.
To create a custom product mapping:
Access:
Admin
Step 1
Select
Policies
> Application Detectors
, and click
Custom Product Mappings
.
The Custom Product Mappings page appears.
Step 2
Click
Create Custom Product Mapping List
.
The Edit Custom Product Mappings List page appears.
Step 3
Type a name in the
Custom Product Mapping List Name
field.
Step 4
Click
Add Vendor String
.
The Add Vendor String pop-up window appears.
Step 5
In the
Vendor String
field, type the vendor string that identifies the applications that should map to the
selected vendor and product values.
Step 6
Select the vendor you want to map to from the
Vendor
drop-down list.
Step 7
Select the product you want to map to from the
Product
drop-down list.
Step 8
Click
Add
to add the mapped vendor string to the list.
Step 9
Optionally, repeat steps
to
as needed to add additional vendor string mappings to the list.
Step 10
When you finish, click
Save
.
The Custom Product Mappings page appears again, with the list you added.
Editing Custom Product Mapping Lists
License:
FireSIGHT
You can modify existing custom product mapping lists by adding or removing vendor strings or changing
the list name.
the list name.
To edit a custom product mapping:
Access:
Admin
Step 1
Select
Policies
> Application Detectors
, then click
Custom Product Mappings
.