Verify a custom SID list from Firepower sensors using CLI and FMC GUI

Introduction

This document describes how to get a custom SID list from Firepower Threat Defense (FTD) or FirePOWER module using CLI and FMC GUI. SID information can be found on FMC GUI if you navigate to Objects > Intrusion Rules. In some cases, to get a list of available SIDs from the CLI is necessary.

Prerequisites

Requirements

Cisco recommends that you know these topics:

• Cisco Firepower Threat Defense (FTD)
• Cisco ASA with FirePOWER Services
• Cisco Firepower Management Center (FMC)
• Linux basic knowledge

Components Used

The information in this document is based on the following software version:

• Firepower Management Center 6.6.0
• Firepower Threat Defense 6.4.0.9
• FirePOWER module 6.2.3.2

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

An intrusion rule is a set of keywords and arguments that the system uses to detect attempts to exploit vulnerabilities on your network. As the system analyzes network traffic, it compares packets against the conditions specified in each rule. If the packet data matches all the conditions specified in a rule, the rule triggers. If a rule is an alert rule, it generates an intrusion event. If it is a pass rule, it ignores the traffic. For a drop rule in an inline deployment, the system drops the packet and generates an event. You can view and evaluate intrusion events from the Firepower Management Center web console.

The Firepower System provides two types of intrusion rules: shared object rules and standard text rules. The Cisco Talos Security Intelligence and Research Group (Talos) can use shared object rules to detect attacks against vulnerabilities in ways that traditional standard text rules cannot. It is not possible to create shared object rules. When intrusion rules are written on your own, standard text rule must be created. Custom standard text rules to tune the types of events you are likely to see. By writing rules and specifying the rule’s event message, you can more easily identify traffic that indicates attacks and policy evasions. 

When you enable a custom standard text rule in a custom intrusion policy, keep in mind that some rule keywords and arguments require that traffic first be decoded or preprocessed in a certain way.

A custom local rule on a Firepower System is a custom standard Snort rule that you import in an ASCII text file format from a local machine. A Firepower System allows you to import local rules using the web interface. The steps to import local rules are very straightforward. However, to write an optimal local rule, a user requires in-depth knowledge of Snort and networking protocols.

Warning: Make sure you use a controlled network environment to test any intrusion rules that you write before you use the rules in a production environment. Poorly written intrusion rules may seriously affect the performance of the system

Network Diagram

Configure

Import Local Rules

Before you begin, you need to make sure the rules listed on your custom file do not contain any special characters. The rule importer requires all custom rules to be imported using ASCII or UTF-8 encoding. The procedure shown below explains how to import local standard text rules from a local machine.

Step 1. Access the Import Rules tab by navigating to Objects > Intrusion Rules > Import Rules. The Rule Updates page appears as shown in the image below:

Step 2. Select Rule update or text rule file to upload and install and click Browse to select the custom rule file

Note: All uploaded rules are saved in the local rule category

Step 3. Click Import. The rule file is imported

Note: The Firepower Systems do not use the new rule set for inspection. To activate a local rule, you need to enable it in the Intrusion Policy, and then apply the policy.

Verify

From FMC GUI

1. View local rules imported from FMC GUI

Step 1. Navigate to Objects > Intrusion Rules

Step 2. Select Local Rules from Group Rules 

By default, the Firepower System sets the local rules in a disabled state. These local rules must manually set the state of local rules before you can use them in your intrusion policy.

2. Enable a local rule from Intrusion Policy

Step 1. Navigate to Policy Editor page under Policies > Intrusion > Intrusion Policy

Step 2. Select Rules in the left panel

Step 3. Under the Category, select local. All of the local rules should appear if available:

Step 4. Select the desired local rules:

Step 5.After selecting the desired local rules, select a state from Rule State

The following options are available:

- Generate Events: Enable the rule and generate an event

- Drop and Generate Events: Enable the rule, drop the traffic, and generate an event

- Disable: No enable the rule, no events

Step 6. Once the rule state is selected, click on the Policy Information option on the left panel

Step 7. Select the Commit Changes button and provide a brief description of changes. Click on OK later. The Intrusion Policy is validated.

Note: The policy validation fails if you enable an imported local rule that uses the deprecated threshold keyword in combination with the intrusion event thresholding feature in an intrusion policy.

Step 8. Deploy the changes

From FTD or SFR module CLI

1. View the local rules imported from FTD or SFR module CLI

Step 1. Establish an SSH or CLI session from your SFR module or FTD

Step 2. Navigate to expert mode

> expert
admin@firepower:~$

Step 3. Get administrator privileges

admin@firepower:~$ sudo su -

Step 4. Type your password

admin@firepower:~$ sudo su -
Password:
root@firepower:~#

Step 5. Navigate to /ngfw/var/sf/detection_engines/UUID/intrusion/

root@firepower:/home/admin# cd /ngfw/var/sf/detection_engines/70f28390-f73d-11de-acfc-2369c038cbc9/intrusion/
root@firepower:/ngfw/var/sf/detection_engines/70f28390-f73d-11de-acfc-2369c038cbc9/intrusion#

Note: If you are using SFR module, do not use /ngfw/var/sf/detection_engines/*/intrusion path. Insted use /var/sf/detection_engines/*/intrusion

Step 6. Introduce the following command

grep -Eo "sid:*([0-9]{1,8})" */*local.rules

Refer to the image below as a working example:

root@firepower:/ngfw/var/sf/detection_engines/70f28390-f73d-11de-acfc-2369c038cbc9/intrusion# grep -Eo "sid:*([0-9]{1,8})" */*local.rules
sid:1000008
sid:1000023
sid:1000007
sid:1000035
sid:1000004
sid:1000000
...

This will list the customer SID list that is enabled by the FTD or SFR module.

Troubleshoot

Step 1. Make sure SSH session is established to SFR module or FTD, from FMC detection_engines is not listed

Step 2. The command grep -Eo "sid:*([0-9]{1,8})" */*local.rules only will work under intrusion directory, the command cannot be used from another directory

Step 3. Use the command  grep -Eo "sid:*([0-9]{1,8})" */*.rules in order to get a complete SID list from all categories

Best Practices for Importing Local Intrusion Rules

Observe the guidelines when importing a local rule file:

Related Information

Here are some documents for reference related to snort SID:

Update Intrusion Rules

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/System_Software_Updates.html#ID-2259-00000356

The Intrusion Rules Editor 

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/the_intrusion_rules_editor.html