Cisco Cisco Firepower Management Center 4000
49-10
FireSIGHT System User Guide
Chapter 49 Scheduling Tasks
Automating FireSIGHT Recommendations
Automating FireSIGHT Recommendations
License:
Protection
You can automatically generate rule state recommendations based on network discovery data for your
network using the most recently saved configuration settings in your custom intrusion policy.
network using the most recently saved configuration settings in your custom intrusion policy.
Note
If the system automatically generates scheduled recommendations for an intrusion policy with unsaved
changes, you must discard your changes in that policy and commit the policy if you want the policy to
reflect the automatically generated recommendations. See
changes, you must discard your changes in that policy and commit the policy if you want the policy to
reflect the automatically generated recommendations. See
for more information.
When the task runs, the system automatically generates recommended rule states. Optionally, depending
on the configuration of your policy, it also modifies the states of intrusion rules based on the criteria
described in
on the configuration of your policy, it also modifies the states of intrusion rules based on the criteria
described in
. Modified rule states take
effect the next time you apply your intrusion policy. See
for more information.
To automate rule state recommendation generation:
Access:
Admin/Maint
Step 1
Select
System > Tools > Scheduling
.
The Scheduling page appears.
Step 2
Click
Add Task
.
The New Task page appears.
Step 3
From the
Job Type
list, select
FireSIGHT
Recommended Rules
.
The page reloads to show the options for generating FireSIGHT recommendations.
Step 4
Optionally, click the
policies
link next to the
Job Type
field to display the Detection & Prevention page,
where you can configure FireSIGHT Recommended Rules in a policy. See
for more information.
Step 5
Specify how you want to schedule the task,
Once
or
Recurring
:
•
For one-time tasks, use the drop-down lists to specify the start date and time. The
Current Time
field
indicates the current time on the appliance.
•
For recurring tasks, you have several options for setting the interval between instances of the task.
See
See
for details.
Step 6
In the
Job Name
field, type a name using up to 255 alphanumeric characters, spaces, or dashes.
Step 7
Next to
Policies
, select one or more policies where you want to generate recommendations. You have the
following options:
•
In the
Policies
field, select one or more policies. Use the Shift and Ctrl keys to select multiple
policies.
•
Click the
All Policies
check box to select all policies.
Step 8
Optionally, in the
Comment
field, type a comment using up to 255 alphanumeric characters, spaces, or
periods.