Cisco Cisco Firepower Management Center 2000
6
FireSIGHT System Release Notes
New Features and Functionality
Protected Rule Content
A new capability of the Snort rule language is available for use in high-security environments. You can now create a Snort
content match using hashed data. This allows the rule writer to specify what content to search for, but never exposes
the content in plain text.
content match using hashed data. This allows the rule writer to specify what content to search for, but never exposes
the content in plain text.
Previously Changed Functionality
The following functionality was introduced in Version 5.4.0.6 and 5.4.1.5:
If the system detects a URL and cannot categorize the requested URL from prior lookup results, the system attempts
a secondary URL lookup method. If the URL cannot be categorized within two seconds using the secondary URL
lookup method, the system assigns the URL the Uncategorized category and processes the URL.
a secondary URL lookup method. If the URL cannot be categorized within two seconds using the secondary URL
lookup method, the system assigns the URL the Uncategorized category and processes the URL.
The SMTP preprocessor now generates an alert for multi-line authentication command overflow attempts.
The system now restricts reassembly of packets once the system reaches the max HTTP server flow depth and
decreases latency in traffic processing.
decreases latency in traffic processing.
The following functionality was introduced in Version 5.4.0.5 and Version 5.4.1.4:
VLAN tags are now limited to integers between 0 and 4095.
The system now supports matching SSL traffic on all port values, including values 32,768 and larger.
If the system detects a URL and cannot categorize the requested URL from prior lookup results, the system attempts a
secondary URL lookup method. If the URL can not be categorized within two seconds using the secondary URL lookup
method, the system assigns the URL the Uncategorized category and processes the URL.
secondary URL lookup method. If the URL can not be categorized within two seconds using the secondary URL lookup
method, the system assigns the URL the Uncategorized category and processes the URL.
The following functionality was introduced in Version 5.4.0.3 and Version 5.4.1.2:
You must apply the same access control policy to all devices that you plan to stack or cluster before you configure
the stack or cluster except in cases where an applied configuration requires the Snort process to restart. See the
How Snort Restarts Affect Traffic section in the FireSIGHT System User Guide.
the stack or cluster except in cases where an applied configuration requires the Snort process to restart. See the
How Snort Restarts Affect Traffic section in the FireSIGHT System User Guide.
You are now able to choose to inspect traffic during policy apply to prevent network disruption.
The system no longer reports the discovery event status to the Health Policy page.
You can now create an access control policy that references either an access control rule network condition set to
block all IPv6 addresses with ::/0 or a network rule set to block all IPv4 addresses with 0.0.0.0/0 is now supported.
block all IPv6 addresses with ::/0 or a network rule set to block all IPv4 addresses with 0.0.0.0/0 is now supported.
The system now reports an event for all CPU reports when CPU usage changes from a high level to a normal state.
The following functionality was introduced in Version 5.4.0.2 and Version 5.4.1.1:
The system now clears all intrusion policy locks when you upload intrusion rules or install intrusion rule updates.
The following functionality was introduced in Version 5.4.1:
Registered ASA devices now have configurable advanced options on the Advanced tab of the Device Management
page (Devices > Device Management).
page (Devices > Device Management).
The show users CLI command is now supported on ASA devices.
You can configure alerts only for retrospective events or network-based malware events from the Advanced Malware
Protections Alerts tab on the Alerts page.
Protections Alerts tab on the Alerts page.
The following features and functionality were updated in Version 5.4:
You can now view VLAN tags for connection events in the event viewer (Analysis > Connections > Events).
The system now identifies login attempts over the FTP, HTTP, and MDNS protocols.