Cisco Cisco Firepower Management Center 2000

FireSIGHT

The Cisco PIX Block Destination remediation allows you to block traffic sent from the destination host 
in a correlation event.

Do not use this remediation as a response to a correlation rule that is based on a discovery event; 
discovery events only transmit a source host and not a destination host. You can use this remediation in 
response to correlation rules that are based on connection events or intrusion events.

Admin/Discovery Admin

Select 

.

The Instances page appears.

Next to the instance where you want to add the remediation, click 

. 

If you have not yet added an instance, see 

.

The Edit Instance page appears.

In the 

 section, select 

 and click 

.

The Edit Remediation page appears.

In the 

 field, enter a name for the remediation.

The name you choose cannot contain spaces or special characters and should be descriptive. For 
example, if you have multiple Cisco PIX firewall instances and multiple remediations for each instance, 
you may want to specify a name such as 

PIX_01_BlockDest

.

Optionally, in the 

 field, enter a description of the remediation.

Click 

, then click 

.

The remediation is added.

FireSIGHT

The Cisco PIX Block Source remediation allows you to block any traffic sent from the source host 
included in the event that violates a correlation policy. The source host is the source IP address in the 
connection event or intrusion event upon which the correlation rule is based, or the host IP address in a 
discovery event.