Cisco Secure Firewall feature focus: SnortML

Alright, once again, thank you for joining our, our Cisco feature focus webinar, snort ML. This is the 1st in a new series of webinars designed to focus on specific features.00:10Within our Cisco secure Firewall product. My name is Harry Davis and I'm the director of customer adoption for secure Firewall Product. Joining me today and leading this session through this customer success specialist. Joseph Moore and Yanokasha Casias.00:20Before we start, a couple of housekeeping notes. Please feel free to ask any questions in the Q and A section. Our panel will answer as many of those as possible. We anticipate this material will take between 30 to 40 min leaving us ample time to answer some of your questions five. Once the event ends, we will capture any answers and answer any outstanding questions of.00:33Follow up email to all the attendees. And finally, there'll be a short survey.00:54Asking you about the webinar and option to request further adoption assistance if you need it. With this completed, I will hand this over to Joseph to kick off the session. Joseph. Thanks Harry and welcome all to this presentation on Snort ML. So when talking about snortml.00:58Now I wanna 1st talk a bit about.01:18Cisco Talos, so Talos of course is the threat intelligence organization inside of Cisco, and its 1st priority is protecting our customers. That's the mission. So what that means for you, our customers, if your Cisco secure product blocks something, the odds are.01:20Where the Talos intelligence is behind it. That blocking of threats is becoming increasingly important as the digital world is expanding at an unprecedented rate. Attack opportunities are expanding just as quickly. Attacks are becoming more sophisticated as attackers constantly innovate.01:40Effect evidence by recent attacks such as the solar winds and Casseya supply chain attacks at a bevy of major ransomware operations that shut down everything from schools to oil pipelines. The modern landscape is made up of all kinds of threats coming at defenders from all possible vectors such as email network, endpoint, cloud, and more. We now.02:00Live in a world where running the middle com commodity malware can lead to a multi million dollar incident and much the same way as a target attack from a state sponsored actor could. The threat landscape today is a scary place. So how does Cisco go about protecting customers in such a scary place? Well, begins with obtaining the best threat intelligence.02:20Telus does that by ingesting mountains of data every day from sources all over the world such as Cisco secure products and Intel partners. Telus maintains hundreds of Intel partnerships, including the cyber threat alliance, the ransomware task force, and the joint cyber defense collaborative, which all allow critical intelligence to be shared and disseminated collector.02:39Among the security community.02:59Gathering data from multiple worldwide sources provides Talos with immense visibility, and after all if you want to stop more, you have to see more. The help of grand baking machine learning and AI methods. Tell us researchers come through these mountains of data, then using the researcher's findings tell us intelligence.03:02On the latest cyber threats. Tell us feeds intelligence on the latest cyber threats to all security Cisco secure products. Pardon me there. This process of continually receiving telemetry from the Cisco secure products that are out in your networks and feeding intelligence back to them enables us to constantly improve our detection, provide real time intelligence.03:20Ensuring that your, devices are.03:40Effectively and efficiently blocking threats. Talos is greater than some of the parts. We have a diversity of data, breadth of partnerships and proactive capabilities that feed each other acting as an ongoing multiplier of effectiveness. So Talos combines data global data collection extensive.03:44Of industry partnerships and advanced machine learning to deliver real time threat intelligence and continually enhance protection for every customer environment, every event, every single day all around the world.04:04Well let's walk through how this works. Keeping in mind this is happening in every customer environment for every event, every single day. We prioritize what's going on in the threat landscape, so as adversaries evolve and start to.04:15Targeting new file types and vectors. Talos can build engines to defend customers more effectively. For tell us that are three core aspects of what we do. Collect, analyze, and defend, NO matter what, where a threat comes from or how it is analyzed, it results in the ability to defend organizations through one of four different deliverables from Talos.04:35And those four deliverables, creating detections in the webs infrastructure through honeypots, spam chats, updating our malware library releasing information through our creet program, which is a collaborative research exchange between Talos and customers. All of this helps improve real world detection and.04:54Provide participating customers with leading edge Intel.05:14Automation and algorithms, working with machine learning, blocking phishing URLs, email classification and auto signature creation. Security research. So ensuring that defenders are kept up to date with the latest developments in the threats landscape, and this information is collected.05:18Through Talos incident response engagements, threat hunting vulnerability research, and reverse engineering. And then there is how we defend.05:37Directly through Cisco products and updating them to block the latest attacks, as well as our Talos incident response services. Through this we have law enforcement and government partners as well as industry partners, and we have open source tools which are available for any security defender to download, used to upskill themselves or use within.05:46Their security environment.06:05And so adversaries are opportunistic when new vulnerabilities emerge, but discipline and continuing to exploit known weaknesses that remain unaddressed. Rapid weaponization reflects automation and better information sharing within adversary ecosystem.06:09Patience reflects an understanding that technical debt remains abundant. So this creates a dual burden for our defenders.06:30So they need to both reduce time to patch for high impoked high impact exposures. Excuse me, and systematically eliminate long standing weaknesses especially in legacy and identity infrastructure. Because of this organizations must move beyond reactive patch cycles.06:38Toward continuous exposure management. Prioritizing assets that broker access, validate trust or sit at architectural choke points. Take away, speed matters, but so does structural resilience. There are too many vulnerabilities and exploits for any one organization to protect against.06:58Even if we had signatures for every single exploit out today, there will be more tomorrow. We need an approach to the fence that doesn't require priority knowledge of the attack to function. And that is in part where snort ML comes into play.07:18So, traditional IPS rules, they're based on known and fixed patterns, but slight changes to payload patterns can evade static signatures. Undisclosed or new vulnerabilities will those take time for researchers to identify and then to convert and create signatures for and get those deployed out to your device.07:38Snort ML uses machine learning to expand ipa's capabilities. Trained on all known embodiments for a given vulnerability type, it detects new patterns for the vulnerability without a static signature.08:00Now, I do want to mention that snortml does need to see the payload to function. So TLS or quick decryption is required. Now, I do wanna, note you can also use the encrypted visibility engine, which we actually had a previous webinar on, which you can should be able to view on our community pages. You can use Eve for the traffic.08:15Which you cannot decrypt. And we also have new features like the intelligent decryption bypass, which dynamically identifies which traffic should or should not be decrypted based on a risk score, and there's some other improvements around decryption policy and decryption hardware in our newer firewall models as well.08:35Oh, snort mL blocks detected malicious traffic in line as the traffic passes through the firewall. We don't, it does not require an ongoing cloud communication for detections. The models live within the firewall.08:53And the decisions are made there at the firewall. There's NO need for a call out to a remote service. It all happens there as traffic passes through the firewall. The machine learning models provide a fundamentally new way of detecting and blocking exploits.09:12ML models don't require knowledge of the specific vulnerability to function. Training ML models on the entire exploit class provides coverage for new, any new exploits within that class while also still protecting against known vulnerabilities within that class.09:32So a little bit of about the way Snort works and how snortml interacts with other components. So snort mL subscribes to the HTTP inspector within the snort engine. The HTTP inspector is the service within snort.09:53Specifically looking at HTTP requests and the contents of those requests.10:07So snordaml subscribes to that service, sees the, the URIs coming from those connections, and using the ML models that are trained on these vulnerability classes, SQL injection, command injection, and cross site scripting.10:13Snort ML is able to detect existing vulnerabilities, but also detect new zero days before researchers have detected and written rules for it.10:31Now or.10:51Keeping SNORTML up to date, we want to make sure that you keep your LSP, your snort rule updates basically regularly up to date. So regularly updating the intrusion rule updates, which are delivered through the LSP, that's crucial keeping all of your detections up to date. The snort ML model files are also updated.10:52Through this LSP, so it's a good idea to have your FMC checking for newly available LSP rule updates weekly.11:12Snort ML is enabled by default in the maximum detection base intrusion policy. However, we don't recommend using that based base policy in production environments. In any custom intrusion policy, you can enable snortml to block malicious traffic by setting rule 04:11 colon one to the block action, and we'll go over the configuration here.11:21Next as well show that in the demo. So in your FMC, you'll navigate to the intrusion policy and you'll select the snort three version.11:40In the summary tab, you'll click on view effective policy and in the filter bar, you'll type in the filtered GID equals 04:11. So GID is the generator ID. It's in a concept for sort of where the signature came from and what its purpose is.11:59And then the signature ID, right now we only have one under this GID, which is signature ID one, so 4111, you can also use that as a filter there to search for the individual rule. Once you have found the rule, you'll.12:16Hit the rule action dropdown and you'll change that from disabled to block, and at that point, once you've deployed configuration to your firewalls, snortml will then be able to block those potential threats.12:36Once you have that in place, you can then also view events related to snort ML. So in the unified events viewer, you can filter by intrusion message and then put in snort_ML and that will pick up any, intrusion.12:52Events where SNORTML was involved in the detection. And to get a little bit more details on those events, you can click on the angle brackets on the left side that will pop up a menu on the right side and you can scroll through there to get various details about the connection.13:12But in particular, we can see the snort rule, and so this is the, as you see there, the GID 04:11 SID one, this is the snort ML rule, and we also can find out what URL triggered the detection.13:30So, from here I'm going to hand it over to Gihang for the demo. Thanks Joseph. I'm gonna stop sharing here. All right. So.13:46Let's start with this demonstrationl configuration and operation. We will configure the snort email in intrusion policy and simulate some attacks so we can observe snort emails detection capabilities. Start by logging into the FMC and remember that snortml was introduced in release seven.six, so you have.14:02Have to be running at least that version in order to make use of it. Now let's go to policies and intrusion.14:22Select the policy, the intrusion policy that you're gonna be working with, and we're going to click on this version. We can dismiss the about intrusion policies window, and the 1st thing to check is the base policy. So if you're creating a new intrusion policy from scratch, you will need.14:28Need to select the base policy that you wanna use. Otherwise, if this is an already created intrusion policy, like in this case, you can see the base policy at the top, and I am using balance security and connectivity. So each base policy contains a set of rules enabled by default, so you can go to base policy.14:48And you will find multiple rule categories and under each category you will find different groups. And for each group you will find all the intrusion policy and the intrusion rules that are enabled by default according to your base policy.15:07Now let's go back to the summary. Here you can see like the total number of rules that are enabled. Some of them are blocking traffic, some of them are just generating some alerts. And well, as mentioned before, the rule is disabled by default when you're not using the maximum detection of.15:24Base policy, like in this case, so in order to enable the ML rule, we're going to view effective policy here.15:44Click there and we're gonna use the search bar using the GID that Joseph mentioned before one one and that will show the snort ML rule. So as you can see these disabled by default. If we take a look at the details here, you will find the message that you will receive.15:54When any of these events are triggered. So we're gonna, click on the dropdown menu to select the action of block.16:14We overwrite and that should be it. Now, let's go to the access control policy. Select the policy that is assigned to your FTD. We're gonna make some changes.16:24And just for the purpose of this demo, I do have this rule at the top allowing all the traffic and being inspected by the intrusion policy that we just changed, which is the cloud balanced intrusion policy. So, that's pretty much it. That's all that we need. So now, I am going to.16:46Deploy all the changes to my ftds.17:06And in the meantime, let's go to a Linux machine so that we can trigger some attacks and we can get some events on the FMC. So now that we are on the client side, I will be running a script that I prepare for this demo. The script sends multiple HTTP requests from this Linux machine to a server, inject.17:10A variety of normal and malicious looking inputs into URL parameters and post data. So pretty much it forces HTTP traffic so it can be inspected by the firewall and well then will analyze the request contents and will trigger some alerts when suspicious patterns are detected.17:30So I run the script.17:50And now we're ready to go back to the FMC and check the for the interestion events. Give it a minute to run. Okay, so back in the FMC, all devices are up to date now, so we can go to.17:52And logs.18:12And we are gonna be using unified events. Okay, so 1st thing that we need to do is to add a new column here so that we can see the intrusion message. We're gonna enable that one and hit apply.18:14Just give it a moment to load, and we're gonna use the search bar. In this case, I will be filtering where the source IP address of the Linux machine that I used, which is this one and I'm gonna hit apply.18:35And we should start seeing some intrusion events with the snort ML message. As you can see, we got a couple of intrusion blocks here. So let's look for the intrusion message column to see which one.18:54Has this normal message. Okay, so we we have one event here. So in order to see more details, let's see enrichments and as you can see, this traffic was blocked. It was considered an intrusion using the access control post.19:11See that we modified and by the rule that we have at the top of the policy, if we take a look at the intrusion policy.19:31We are going to see 1st intrusion message pointing to this rule, which means a potential threat founding these HTTP traffic. We're using the D cloud balanced intrusion that I showed you at the beginning of this demo. And of course here we can again see the.19:40Rule details like the message and and that. So that concludes our demonstration on how to enable a snortal rule and how you can trigger some alerts to start seeing some some events. So with that, I'm passing the ball back to Joseph.20:00Yeah, thanks John. Yeah, so that is the end of the presentation, but we do have some time for questions. However, I do want to mention a couple of resources that we have available. So the secure Firewall YouTube channel has a lot of great videos.20:20Feature overviews for, for new releases, specific feature deep dives, configuration guidance, troubleshooting tips, and so on. Likewise, we have our secure.cisco.com site. This is also called the secure Essentials hub. And there we have.20:40Feature highlights, kind of one pagers step by step guidance and lots of guides on specific features or overall functionality. So definitely recommend you check both of those out.21:00So thank you for your time and please let us know if there are any more questions you have on SNORTML. Yeah there's a couple in chat that if you guys don't mind, I'll read out loud. I think I'm gonna see some of them are answered, but we probably can follow up on them.21:14Too do this when one was already answered. This is an interesting one, we may not have a good answer, you know, off the top of our heads, but how effective is enabling GID 04:11 with only Eve active? I would feel without proper tuning it could block unknown traffic, and if there's if there is an only enforced if.21:30So for when you're asking with only an even only event active, I assume you're saying without decryption, maybe clarification on that would be good, but.21:51In the case of Eve. And without decryption yes. Okay. So Eve does not allow snort ML to function. SNORTML actually needs to see the payloads so it does require decryption. Now.22:07Eve is a great feature to run in parallel with snortml with with our intrusion policies and other security tools like security intelligence, because it can see through fingerprinting client hellos information about those encrypted connections that we other.22:24Guys would not be able to see. Now, even if we are doing decryption where we're going to be applying snormal to traffic, we're not gonna decrypt everything.22:43So we have E for the traffic that we either can't decrypt or or would not decrypt for whatever reason. And then we have snortml to snortml and the rest of our intrusion policy to dig in deeper on the traffic that we do do actually perform decryption on. Cool. Got a couple.22:51I'm gonna consolidate a few though. Someone said Brandon, good question, couple good questions here. I see 411.23:11Calling one on seven four can it be enabled on this version or does it need to be seven six? There's another question around snort ML on seven six, maybe want to answer that one 1st? Yeah, so 77.six is the minimum requirement version and I believe that requires both your FMC and your ftds to be on seven six.23:21Is there again this is another great or higher, is there an increase in overhead or resources on the FTD when enabling? No, NO considerable increase, you know, enabling any feature, any particular intrusion rule is gonna have some impact, but it's, it's, it's not any more impact than in enabling any other particular.23:41That's, it's not significant.24:01Oh, and a couple I'm gonna just there's a there's a they're flying in now That's great. Thank you for all the questions. Why is this rule disabled by default and is it recommended to be set to block? Sure, so it is a new functionality, so we are.24:03With the initial deployment of it.24:23We thought caution is probably better, but in future releases, there is an expectation that it will be enabled by default in some of the other base policies, not sure in specifics of that yet when that would be coming or what, which policies, but.24:25This is a really important feature going forward. But to start we didn't want it to be enabled by default just because it's, you know, this a little bit new machine learning involved. So, ok, I'm just trying to catch up on the questions.24:44Since this is not only enabled default by max detection policies, what are the recommendations on when and where to use it? Should it be applied sparingly and precisely to custom IPS policies as opposed to globally on a base policy? And again, I I think this is a case by case thing, but i'd love to hear, you know, anybody on the panels your your feedback on this.25:02Yeah, Harry I I would agree with that case by case basis is a good recommendation. You know, with, with any intrusion policy with any with any security measurement that we're applying to our traffic, there's always a trade off right of connectivity versus security.25:21So if you're, if you're unsure, you could. I, I think there was another question earlier about this. You could enable it in the alert status so you can see how it would affect your traffic before switching it on to block.25:40That's, that's one mechanism you could use to to see, you know, is this gonna be too much or or or what impact it would have? Yeah. Oh, the pile of questions, they're coming in fast and furious here, so give me I apologize, give me just a second here. Does that.25:58IPS need to be enabled? Yes. Oh, yes, IPS does need to be enabled. This is a rule within your intrusion policy, so it is it is monitored mode only when using IDS, when using IDS. IBS. Sorry could you rephrase that?26:17Can the GID be enabled in monitor mode? The individual GID you could enable as an alert only, alert action on that rule, if you're wanting to see what its impact is before switching it over to block. Alright, there's a plat I'm just making sure I'm not missing questions there is duplicate.26:35Here we have this is a good one where what's in place to help reduce false positives with sorted now? Is there a confidence score? Can the admins select certain confidence scores to determine if the traffic is blocked or not? We do not have it doesn't use a confidence score, where you can, you know.26:55Set a threshold, something like that. The, the main mechanism we have, and this is true with any intrusion rule, especially the ones that detect based on a URL. If you see a detection that looks like it is.27:15Looks like it's saying something's malicious that looks a little bit more normal. You can open a support case to request an investigation into false positive. We talked about resource intensive. It's basically somebody asked, is it, you know.27:33Any impact at large scale, 20 gig throughput plus I think we said.27:53The answer was there's minimal impact based on, you know, like with any feature, but that's enabling has is minimal impact to the resource availability of the box, correct? That's correct, yeah. Similar to enabling other intrusion rules. Going down through the list, I see some answers, I see some questions.27:58Decryption sometimes breaks content. Can we also filter which creates another set of challenges? What is the high, what is the end goal of managing higher and higher encryption loads? Interesting question. Well, the end goal is, is to detect the threats where we can, right? So there are gonna be some.28:17Some types of encrypted traffic that we're not gonna be able to decrypt so we have introduced some mechanisms when using decryption policy to not decrypt those types of traffic we know are not possible to decrypt, to not decrypt those types of traffic. We know cause legal issue.28:38Use like medical and financial traffic.28:57And, as I, I mentioned briefly earlier, we have now this started in seven.seven, the intelligent decryption bypass. What that does is it looks at the risk score of traffic, and this is interacts with the Eve engine to set those risk scores and traffic.29:01That's considered generally safe, you know, connecting to a well trusted SaaS environment, e.g..29:22That traffic will be allowed without decryption. Anything that is considered malicious, we can block that with Eve or another security tool. And then the traffic that's in the middle, which in in previous testing was around 12 % and in some of our test networks, that traffic is what.29:28We look at actually decrypting, so that would not include those, those connections where.29:48Decryption could be an issue and of course if you know that you have applications within your network, where decryption could cause problems, we would want to, to also set bypasses for those in the decryption policy. So there's a lot of components to that, but.29:55We do have mechanisms to help decrypt just what we need to decrypt. And, and one of the reasons why we like to have these answer these questions live is Anya gave a really good response and Joseph got a chance to expand upon it. So this is this is the reason why we do this. I'm gonna go through and see if there's.30:13There's a question about snort ML and Eve being incompatible. I don't think that's the right I think that's the question, William, I'm trying to I'm just paraphrasing right, can we do is it, can we talk about the functionalities supporting each other even snort ML or.30:34I wouldn't call them incompatible. It's, it's more that they target different.30:51Different segments of of the traffic that we're dealing with. So Eve is focused on that traffic which we which will remain encrypted primarily. And it's gonna be able to detect malicious activity within those encrypted flows.30:57Snorton L is going to be used on traffic that we have decrypted, and it's going to be able to tell more about specific requests that are being made through those, those decrypted sessions. So things like you know a user putting in.31:15The threat actor putting into an authentication field, some garbage that makes the, the SQL database that it's referring to output the, the admin credentials. We don't want that to happen. So snortml.31:33And our other intrusion signatures have the ability to detect that and block that as it happens. I think this is a really good question and I didn't know if we're gonna be able to answer it completely in this call, so by the way the rest of the panelists by all means chime in if you wanna have a little bit of.31:49Session.32:09How does this fit in with using the full SSL decryption with Umbrella, SIG SWG versus SSL decryption on the FTD? So it's a pretty broad conversation, but i'd love to get your, your thoughts and inputs on this. Yeah, yeah. So umbrella, of course.32:09Is another one of our our great security tools here at Cisco.32:29And it has, you know, slightly different use cases, these can complement each other. You you know deciding where you decrypt, how you decrypt and what tools you use to decrypt is of course gonna come down to the needs of your organization.32:34But there maybe situations where you have umbrella for say your, your internet edge, but you may also want to perform decryption and deeper inspection somewhere else in your network as well.32:54So you might have an internal firewall doing that. Yeah, NO, that's great. And again, one of the you know just to caveat, we're here to give you some best, you know, some feedback on based on best practices and, you know, you can think about how to implement that in your environment if you need and we'll talk about a second, need further assistance for some conversations where we, there's opportunities for us to talk to our doc.33:09So, I see we've still got a lot of good questions here, but I'm gonna I'm gonna take one more right now.33:29You from Craig here, so you mentioned that we have decrypted, I assume that if the traffic is always decrypted, it could, it could also handle that traffic, correct? If the, if the traffic is, is not encrypted, is that what you're saying or or is decrypted somewhere else and then passed through the firewall? Yes yes. Yeah. If, if, if it's if it's HTTP.33:35See if it's already.33:55Either never been encrypted or has been unencrypted before it passes through the firewall. Stored them out can also handle that traffic. Awesome. I covered a lot of the questions here. If there's any more, we'll give it a second or two. And by the way, feel free to ask questions. This is, you know, opportunity for you to speak with our, our team and hopefully we can help draft.33:57Have some concerns or some just.34:17You know, things you didn't know about sort of get another alright well again appreciate the interact engagement, this is this is why we're here for So again.34:20And thank you again for spending time with us on this topic and for all the great questions, this is a really great session and you know and thank you for that. Please complete the survey and be on the lookout for both the Q and A email that it and invites for, for future sessions around features and other firewall related topics. And we will share all the documents we and.34:39I see the vessel, we will send all the information anything from the questions in a follow up email to all the attendees and any related documents in that email, so, and it links that. So again, thank you. We appreciate your time. Thank you for spending with us and I'll end this session.34:59