Hello, and welcome to this video. In today's cyber capsule, we will cover the topic of threat intelligence in Cisco secure Firewall.00:09In such a changing environment, a question we might ask is, how can we keep up when threats are constantly evolving? And for that, we need to have a lot of data and true intelligence. Fortunately, we have Cisco Talos, which is the leading threat intelligence group in the industry.00:19The Cisco Talos team combines all the data it analyzers to generate and deliver threat intelligence for all Cisco security solutions, including the Cisco secure firewall. Within the different updates that we can apply to our secure firewall platforms, we are going to focus on four important.00:38Written databases. The 1st is the vulnerability database, something we also know as VDB. This database will contain known vulnerabilities to which hosts might be susceptible, as well as fingerprints for operating systems, clients, and applications.00:57The system uses the vulnerability database to help determine if there is any host that might be or increase the risk of compromise due to a vulnerability. The Cisco Group Talos is responsible for generating periodic updates of this database.01:15We also have the intrusion rules database or snort, which for Snort two, we will find as SRU. And for Snort three, we will find as LSP. Knowing that weaknesses frequently evolve and new ones are continuously found, the Cisco Talos Intelligence Group.01:34It creates an update for the intrusion rules, so they can be imported into secure firewall management center platforms and implemented on our managed devices. This way, we will be able to have a list of updated rules for new vulnerabilities that have been discovered.01:54These updates are crucial for keeping intrusion detection and prevention systems working well, making sure the network stays safe from both known and new threats. We also have what is the geolocation database, which will contain geographical data such as country.02:14City coordinates, data related to internet connections such as internet service providers, domain names, connection types related to routable IP addresses. When the system detects any geolocation information that matches some of the detected IP addresses.02:34We will be able to see the geolocation information associated with this IP address.02:54And finally, we have the feeds or the security intelligence sources. These are lists that Cisco Telos constantly updates, and these lists will contain information related to IPs and domains. Also URLs of sources known to be malicious.03:00These lists will be classified into different categories such as malware, spam, botnet, fishing, and the advantage of using this information is that in the event any type of connection or communication related to any of these sources is detected.03:18We can minimize the risks related to access to these sources already known and considered malicious by Cisco Talos intelligence.03:38Let's now proceed with the demonstration of this cyber capsule. In this demo, we will see how we can update these different databases. We can do it manually or we can do it automatically, which is the most recommended.03:49Let's start with security intelligence and go to objects, object management. Here we are going to search for security intelligence. Let's select DNS list and feeds.04:06And here we can update the domain, DNS and URL lists. We can do this manually if we check update feeds. Or we can select this pencil to modify the frequency at which we want this task to execute automatically.04:21By default, the frequency is every 2 h, although we can set it to a shorter or longer period. We can do the same for what are the IP or network feeds. We can update manually and update feed.04:43Or automatically, we can then modify the frequency of what is the update of Cisco intelligence feed. We will click here on the pencil. Similarly, the default frequency is 2 h, although we can modify the value as needed.05:01Let's now move on to the system section. We will go to content update. And from here we can perform the update of the different databases. In this case, the vulnerabilities one in VDB update.05:22Or we can do it manually by selecting download update. What this will do is connect the system to the Cisco site and download the latest available version. For this environment, we already have the latest version up to this moment. We can also upload.05:39The file if an administrator connected to the Cisco site and downloaded it.05:59You can upload this file, and once it's available, you can then proceed with the installation in the install section or option. Here we can see which version is currently running on our system.06:06Automatically, we can create a task in system tools scheduling. We can add a task. In task type, we are going to select download of the most recent update.06:24We are going to define the frequency at which we want this activity to be executed. What day do we want it to run? Let's give it a name. We will mark that what will be updated is the vulnerability database and we will save it.06:40This will only be downloading the database and not the installation. If we want to automate the installation as well, we will select it. Let's create a new task. In joby type, we will choose install latest update. We can do it recurrently.07:02We also define the frequency at which we want this to run. We are going to set that we want it to run hours after the database download. Let's set which day we want it to happen and let's give it a name.07:22We select vulnerability database, and here it gives us a warning that when doing this update, a deployment of the configuration must be done. And now we are going to save. And here we see in our calendar that we have two new tasks.07:40One for downloading and one for installation. We return to systems. Let's go check how we can update another database. In this case, the snort rules and rules update. At the top, we can see which versions we are currently running. Both for snort two.07:59And for snort three. The update can be done as a one time task, where we can select this option for the system to download the latest version of this list or rules directly from Cisco's website.08:20Or we can also import a file if an administrator has already downloaded it previously and wants to upload it to the system. And then you can select import. If we check this box, what will happen is that the policies will be deployed.08:40In fact, if we check there, we will see a warning that this may cause a possible temporary interruption of traffic since we are deploying the policies. Or we can also perform this action recurrently, which would be the most advisable.08:58We check this box to enable the Thursday system connects to the Cisco site and can download the latest version of the snort rules. We define the frequency at which we want this to run, whether we want it done daily, weekly.09:18All monthly, at what time we want it to be done, and we can also, by checking this box ensure that when the download of the snort rules is finished, the deploy of the policies is executed.09:33In the rule update log, we can see the download and installed tasks for snort rules, just as shown on the screen. We then have the deal location database.09:52Which we can update as a one time task, either by uploading a file that we have previously downloaded from the Cisco site or we can select download and install, which would make the system connect to the Cisco site and perform the download directly.10:08Or we can configure this action to be executed recurrently by checking enable recurrent weekly updates from the support site. And this will perform the updates of the geolocation database.10:27On a weekly basis, and here we can set when we want this update or recurrence to start. We can set the day and we can set the time and we can save it. And with this.10:42We conclude today's demonstration. Thanks for watching this video.10:58
