Transcript
And we have prepared several topics for you today to go through the latest innovations on the hybrid message firewall technologies, Splank integration.00:10The latest innovations that are introduced in Cisco secure firewall version ten. And on day two we will be discussing some additional capabilities when it comes to using identities with Cisco secure firewall.00:20For VPN and zero trust network access. Before we begin I would like to cover a few items for any questions you may have during our sessions, I would like to ask you to use the Q and A panel that you will find on the right, on the bottom right side of the Webex window. During our session, feel free to post all your questions.00:31In the Q and A and we'll try to answer those questions in real time and or we will have, we can follow up with you after the session if it's absolutely necessary.00:51The team of today we we have a team of six people who will be together presenting and will be your panelists for today. My name is Constantinos. I'm a customer success specialist at Cisco and I've been covering supporting the technologies. And to get today I have with me my colleagues Christophe.01:01Ruben, Luca David and Jacober, who some of us will present me, Christoph and Ruben will be presenting today, While Luca David and Jacob will be covering the topics off tomorrow.01:19For those of you who may have not worked with us before, with the customer success teams, just a couple of words about who we are and what our role is. Customer success is here to help you with technology adoption. Essentially when you want to deploy new technology, you can always.01:31Get support from from our teams so we can make sure that you use the best and the best get you get the best value out of your investments. This is done through a series of different types of sessions. We have adoption consultations which are general discussions where you may want to discuss about some additional topics, maybe bring up some concerns and we can.01:50Help you, with the whole solution so you can find your solutions based on your requirements. We have accelerators which are one to one sessions which are more.02:09Technical and more in depth, so you may have a specific topic in mind. Let's say how to configure and fine tune your IPS, we can set up an accelerator with you and we can discuss the technical details. Shell checks which are activities that can evaluate your current setup and deployment. E.g., you may have deployed the solution and you may want.02:21Do a review you may want to discuss what are the best practices does your configuration are align with our recommended best practices or other things that we may find like missing features, things that you may not be aware about and stuff like that. We can always have a health check with you and we can discuss your current setup and see how we can improve your deployment if.02:42Absolutely necessary. And of course the expert inside series that are organized periodically by our team, where we take some of the most training topics around the hybrid mesh firewall technologies, zero trust domain and the extended detection and response domain, and then we present those topics based on what is the most.03:01As I mentioned, we are presenting the most trending topics based on the customer interests. So if you, if you have any topics in mind that you would like to see in your follow in the next expertise, feel free to also post in the chat and we can take that into account.03:21Yeah, as we said, this is a due day expert insight series, so on day one, this is the agenda for day one and day two. We will start with a quick overview of the Cisco hybrid mesh firewall technologies. Now, this is an expert inside series focusing.03:37On Cisco secure firewall FPD. However, we're gonna see how it plays a role in the greater hybrid mesh firewall portfolio. Then we're gonna do a deep dive on the Cisco secure firewall version ten new features.03:56Following these plan integration and closure of day one. And for day two, we are going to focus mainly on identities, how we can use identity in the policies as long as for VPN and the different types of VPNs for site to site and remote access and of course ZTNA, which is also a very important topic.04:09Oh.04:29Likely. And without any further ado I'm gonna switch to my the 1st part of our today's presentation, which is Cisco hybrid mesh firewall. All right, let's talk about hybrid mesh firewall. Let's see what it is, how it plays a role and how Cisco secure firewall plays a crucial role.04:30Into the Cisco hybrid mesh firewall strategy. We're all familiar with the firewall evolution, right? It started with the same four firewalls back in the nineties where the engine was growing and new attacks were starting were starting appearing. And we needed a device that would basically control the basic flow of traffic, we could.04:50So the inbound and the outbound of traffic, we need to be stateful so we know that if we allow some connection we need to allow the return packets and that was pretty advanced at the time but very basic values standards. Think of very basic appliance is something like Cisco ASA.05:10It was still very popular today, but it it's still very good at doing their basic firewalling. However, internet became bigger and attacks became more sophisticated. So we had the require requirements for something more advanced and this is where the next generation firewall comes into play. We don't just look at flows or pro.05:27Protocols and ports, we're looking at.05:47What kind of users we have in our network? We're looking at what kind of applications they do. We're looking at the payload of the traffic to see if we need to intercept the traffic and inspect it. And we're also of course looking at things like threat intelligence decrypting the traffic if it's necessary.05:50But then we're going through a new phase, a new phase where the applications of the networks are more distributed than ever. We don't have just users, but we have agents in our network. We need to rethink the way we allow access from internal users to our internal applications. So we have the need to identify AI.06:11Applications. We have they need to protect.06:29Servers and applications that are not only on prem but also on private and public cloud. And that requires a new type of firewall architecture. And here is where the hybrid mesh firewall comes into play. Now hybrid mesh firewall is a term that essentially that usually refers to the idea that.06:32You can have one unified management platform and you can manage and configure several firewalls through one management plane. Those are could be your physical firewalls, your virtual firewalls or your cloud based firewalls. And while in many cases this term is pretty accurate, we still believe that it falls short.06:52We believe that the firewall is not just those devices that have a single management plane, but it can also be infused inside your network. And this is where we expand the definition of the hybrid mesh firewall at Cisco where we don't just do the traditional firewalling capabilities, but we're looking to see how we can.07:12Expand those capabilities with the rest of your portfolio. So Cisco secure firewall, has been around for a while. This is basically also the focus of our today's session and it's still the core of the hybrid mesh firewall. However, we may need to go beyond the traditional, we may need to think beyond the traditional perimeter or the traditional network segmentation between what.07:31One physical location another or between one zone and another. And this is where we can look into how we can expand the firewalling capabilities with the use of Cisco ACI in the data center.07:51Where we can do some segmentation there. We can use Cisco secure workload for micro segmentation on the on prem where we do application based segmentation on prem as well as the public cloud. With the smart switches, we can also deploy some of the firewall rules inside.08:01With your network perimeter in sorry inside your network in general, so you don't have.08:21You don't need to have like a standalone physical or virtual device to actually do the packet filtering and the kinds of to do the packet filtering, but you can also rely on the smart suites to filter some packets. With we can also deploy some of those controls in a container environment where basically container environments for party long maybe have been like a.08:26Black box inside your network because you have a whole different architecture there with pods that spin up and down all the time, but the IP address are changing. The context is changing so we are looking to see how we can deploy of course security controls there. With multi cloud defense, we expand the firewalling capability into the public cloud where we can have firewall.08:46Deployed in the cloud, orchestrated, maintained, and so on. And of course, we can also talk about some of the latest additions here.09:06With AI defense where we can track, evaluate and protect AI applications. And of course we can also expand these capabilities into 3rd party firewalls as well.09:15With something we will cover at the end of this 1st session. And of course, we talked about earlier management, right? We still try to consolidate everything under one management platform, which is a security cloud control where all the products with the firewalling capabilities will remain will be there and.09:30They are powered by one unified management plane.09:50We usually talking about the firewalls. We usually used to talk about threat protection and some kind of network, network based segmentation, but we're looking to go deeper than that. We're looking to look into micro segmentation, we're looking into cases of AI security, Kubernetes security, and of course protection, which is not just only.10:14Done by the firewall. We can see how we can basically use the entire network infrastructure for something like that. So let's start by how we can, how some of the latest innovations for Cisco hybrid mesh firewall can prevent some modern attacks. So some of the unique capabilities that you can find in the portfolio include.10:34The early detection of zero dates. Some of the most advanced engines that are powered by Cisco secure Firewall threat Defense are snort ML and encrypted visibility engine, which we'll discuss on the next couple of slides.10:53Because the public cloud is very important. Lots of customers are moving applications there and we see that there's a growing interest into actually deploying the same firewall capabilities in the public cloud with the latest innovations. We do have ways and we will discuss them on how you can actually simplify the deployment of firewalls on the public cloud, and you can.11:05Also make sure that you can maintain high availability in case of an outage. So.11:25We're not just we're going beyond the traditional on premises network. We're looking at the firewall that can be everywhere and can protect any kind of application. And of course integrated segmentation. So as we discussed earlier, the firewalling requirements are evolving all the time. So typically or in the past it used to be.11:32Be Mainly that we had to protect the zone, we had to protect the source and it is based on the source or the destination based on the protocol. However, more requirements came into play, things like identities.11:52Things like application specific. So the firewall may need to be application aware and may need to have more specific requirements. So we can see how all those come together. And we start with the Cisco encrypted visibility engine. May, maybe many of you have heard already Cisco Eve, which is basically.12:02One of the latest, it has been around for a while, but it's still one of the latest innovations Cisco secure firewall. And typically it's it's here to address one of the major concerns of encrypted traffic. Today, the majority of the traffic on the public internet is encrypted and that makes it very difficult if we actually want to inspect it.12:22Typically what we would need to do, we would need to intercept the traffic, try to decrypt, inspect with IPS or file inspection, e.g., reencrypt the traffic, and that has a severe effect on performance. And that does not even let's not even add to the complexity things like certificate management.12:42Certificate pinging but some applications have. So things get very tricky it's very easy to break the connection or to impact the performance of our network infrastructure. So what we do with the if basically we are trying to inspect the traffic and identify some malicious traffic without actually the need for decrypting it.13:01What it does, on a high level is basically fingerprinting the traffic. It's looking at the TLS handshake. It's looking at the protocol the device that is generating the traffic and it's looking at the destination and it can build a risk based, a risk score based on the observed patterns he detects.13:21That can help you inspect the traffic while also still maintain compliance with several with several regulations such as GDPR, e.g.. And it's very easy to deploy and enable with just one click, and of course you can make sure it supports all the latest protocols such as TLS 1.3 and quick.13:40If it's powered by machine learning, so it does have it based on its fingerprinting it can identify what malware would look like. E.g., if you have a malicious process running on a device opening a malicious connection, we can tell where this is.13:59Coming from or where it's going and we can tell with high probability that this is probably some malicious device sorry some malicious traffic that probably needs to be inspected or it needs to be blocked based on the severity. On a very high level.14:14Essentially how it works if inspected packets as they are going through the security firewall and it will generate the score. Now for the majority of the traffic you should expect that this the risk score should be low. For traffic where we know that the risk score is low and there's NO need for any further of inspect, any further inspection, we will.14:30Allow the traffic. However, for the scenarios where we are confident that there's a high risk traffic and we know that this should be dropped, there's NO need to go further with decrypting, inspecting previewing packets or files, e.g., we will block the traffic right away.14:51But in the case of scenarios where the risk is meeting, we're not sure what the traffic is like. Maybe some further inspection would be required, this is where we can actually redirect the traffic for further inspection for 1st decryption and then further inspection. And as you can see on the slide, this should be, this.15:10Is expected to be something like 3.4 % of your overall traffic, which means that unlike before where you had to set up certain parameters and choose what kind of traffic you will decrypt, you can rely on Eve to actually decide what should be decrypted, and then we're seeing a very small percentage of traffic for decryption. Therefore, we are avoiding the.15:28Scenario where we may, we may impact the performance on an appliance.15:48Now snore three has been doing a great job at blocking known attacks. Let's take a SQL injection attacks, e.g.. Snow three is powered by Cisco Talos, it does have a very good set of known signatures for blocking attacks. However.15:56Products are getting more and more sophisticated and sometimes it maybe easy to bypass the static signature just by tweaking the attack a little bit. So this is where snort ML comes into play. It can basically detect unknown variance.16:12Of attacks, once again let's used injection as an example that were not detected before things that we don't have a static signature for for this kind of attacks. So essentially it's a neutral network.16:27Engine which has been trained on excessive data sets of both malicious and benign traffic, and then it knows what an attack should look like. This means it can recognize new variants of attacks without waiting for a new signature to be published by Cisco Talos. As of now, can protect against esqual injections as.16:43And also command line injection and scripting attacks, which are some of the most common ones. Some of the things that I believe it's worth mentioning is that it's an offline engine, so.17:03You can enable it on your devices, it will start working offline, we don't need to export any kind of data to the public cloud. It is updated with the rest of your IPS, so if you are updating yours, you should expect that the snort ML engine will also pick up a few updates that it does require. And of course it has been designed for low latency.17:16Seeing your network, so it's the same, it's a feature which is safe to enable without the concern of actual additional impact on the traffic or on your appliance performance. And.17:36I would like to highlight this is a feature which is there to compensate rather than actually replace your existing snort tools. More on even snort ML will be discussed later today. Now, where are those few features, where we can deploy those features? Cisco secure firewall threat Defense has an extensive set of devices that can be deployed on premise.17:46As well as private and public clouds. We're trying to be also, provider agnostic, meaning that the same capabilities will be available.18:06As you have them on the, on your on premises network will also be available on your virtual environment as well as your cloud providers. So we're trying to be cloud agnostic, so if you have a deployment on AWS or Azure, you should expect that the same capabilities will be available there.18:16Now talking about public cloud, for a while the secure firewall threat defense has been very popular for the on premises networks. However, with the addition of multi cloud defense, we have the capability to deploy some of those firewalls on the public cloud. We actually simplify.18:34The capability of deploying those firewalls there. Multi cloud defense, it is part of the security cloud control and essentially what it does and it integrates with your public cloud providers, and it can ingest visibility, so it can ingest some telemetry statistics from your cloud directly from the cloud providers. It can get some context from.18:52The cloud providers such as what kind of applications and devices you have deployed there.19:12And of course it can deploy firewalls. So typically it is very easy with the multi cloud defense integration to integrate with your cloud provider, choose where you want to deploy your Cisco secure firewalls and the multi cloud defense controller will take care of the rest. We're not talking just about spinning up a VM.19:17On AWS, Azure, Google Cloud or Oracle, but we're also talking about deploying load balancers, updating the listens on the load balancers, configuring the attachments between your applications and your firewalls and of course configuring the routing as well.19:37So, deploying your firewall on the public cloud has never been easier than before, and also it's also worth mentioning some auto scaling and auto and self scaling capabilities, meaning that if you need to have more firewalls or more throughput or redundancy, you can just do that with one click. If one region let's say goes down or another.19:54Building zone goes down, you can also rest assured that the multi cloud defense controller will replace that device where necessary.20:14The AI assistant is there to help you maintain your firewall management and configuration. It is there to help you configure your policy, so you can rely on the assistant if you if you're not sure how you to effectively configure a policy or a new rule, you can always seek.20:24Seek some help from the assistant. Essentially you can ask it as you can see on this screenshot that you you may want to have a request for a rule to be created that will allow certain part of your network to talk to specific application e.g. to help you troubleshoot your policies. Imagine a scenario where you may wanna figure out which rule is actually blocked.20:42Or allowing certain traffic. So instead of spending time and trying to go through the rules, trying to identify which one might you maybe matching, you can always rely on the AI assistant with a very simple prompt and the assistant will help you identify the rules and troubleshoot them.21:02And of course, automate which basically will help you with the entire policy lifecycle. It's not just about creating the rule or just asking a question about a certain rule, but you can also make sure that it can help you maintain this policy set. Sometimes the rule sets, those access control policies they get in.21:17They're very long, they're very difficult to maintain, so you can also always rely on the AI assistant to help you with that. The AI assistant I would like to highlight is available both for the Cloud delivery firewall management center part of security cloud control, as well as for the on prem firewall management center. However, it does, the on prem firewall management center doesn.21:37Not required to be integrated to the security cloud control.21:57And the AI ops in the security cloud control, this is a feature that as of now is currently available only for the cloud delivery firewall management center, which goes beyond what the AI assistant can do. It can provide the summary of your deployment so you can have an idea of how many devices you have in your network, how many of them are healthy, if.22:02Any of them are reporting any problems or if they're overwhelded. The policy analyzer and optimizer, which is constantly evaluating your current access control policies. It's kind of let you know if you have duplicate rules, if some of them are not actually used, maybe they need to be removed or if you can fine tune some of those rules. It can suggest some best practices and it.22:22Recommendations and of course help you with the feature adoption. So if a new feature is out and you have upgraded your firewalls, they can let you know that you're not using some of the latest.22:42Technology so you may wanna learn more and try to activate some of those features. And of course the software upgrade planner, for those of you who maybe managing very large networks and platforms, you may wanna have something that can help you keep track of how many devices are upgraded, what is the current versions running.22:50How many devices you still mainly need to upgrade and so on. And the applications insights which will give you a bird's eye view of all the applications users are using from within your network. Now that was good so far, but let's see how secure firewall here plays a role in.23:11How it extends and it integrates further with the rest of the hybrid mesh firewall technologies. And let's talk a little bit about segmentation. Now, most organizations when they start deploying firewalls and they start building the security, they usually start with the perimeter.23:29And then we need to go more in depth into segmenting into zones. Those zones can be anything from your HQ location, from your certain network all the way to between different locations such as a campus or a data center, can be between where your applications are hosted between different data centers or between the data center to the public cloud. And then we can be as granular as well.23:44Like within the data center and within a per application basis. Now the absolute goal is always to go to move all the way to an intent based applications and build application based policies. However, some, sometimes those charges fall short and we see a lot of customers struggling as they go deeper and building more detailed.24:04Policies and more detailed architectures. So the firewall many times refers or we think of it as the physical appliance that is doing some network layer level segmentation and of course on top of it, some kind of more advanced inspections. But then again, what if we have a large virtual environment? We may need to have.24:24The firewall that will.24:44Segment the traffic between different applications, different servers or different parts of your virtual environment. So we we expand those capabilities into all kinds of environments basically. Kubernetes, in many cases we see a lot of protection at this north and south from Kubernetes cluster or from any kind of container application you have, but we.24:46We may need to have some kind of segmentation within the container platform. And of course the AI workloads. We will cover that as well and we will see how hybrid mesh firewall can help you protect your AI applications both for the other traffic but as well as inspecting the actual payload that comes and goes from an AI application.25:05So with a hybrid mesh firewall and something that you may see a lot across our portfolio is that the capabilities to build intent based policies. And let's start with the use case of the micro segmentation where we may wanna segment our applications based on similar on certain properties. We may wanna say.25:24Not just like that zone A or network A cannot talk to zone or network B, but we may wanna say that certain.25:44The environment from our network can and cannot talk to another application. So we may have a policy that says that our development prop environment cannot talk to our production environment or the other way around. That can be done through the use of Cisco security firewall where we can ingest different several types of dynamic attributes.25:51From the public cloud, from your other on premises resources or from other platforms that may have better visibility on the application side. And you can build function policies based on intent. But of course we can build more advanced micro segmentation policies where we can go into more.26:09In depth, more, let's say fine tuned tailored tools where we can go on and say that not just we talk from a specific zone or from a specific intent to another, but from a specific, we can go on and create policies for individual flaws where we can say that my application A can or cannot talk to the application.26:28B on a certain port, and we can go even more specific and say a specific part of application A can or cannot talk to a specific part of the application B on a specific port. And of course to make it even more specific, we can also build process based rules where we can define that.26:48A certain application can talk to another service on a specific port such as here like e.g. we have the payment processor can talk to our SPL SPL databases. It's not just the application but we go down to the process. So those rules can be very fine tuned, they can be very tailored.27:08Based on your requirements, we can also add more information such as like.27:28The user that's connecting there, e.g., can be a crucial role. And how we basically get all this intent, the intent comes from integration with several applications. Here I would like to bring the example of Cisco eyes. You can integrate Cisco eyes with almost every platform on the Cisco and also on 3rd party.27:32Party platforms and you can get a lot of telemetry from there. The moment something is connected to your network, Cisco Eyes knows. And essentially what we do, we exchange context all the time between the different platforms in the hybrid mesh firewall, all of this. And we can know that.27:52Certain devices with certain attributes can talk to certain device with different attributes. And this can be done with either static data like a host name, an operating system version, a device posture, as well as data we capture dynamic, right? So we see, e.g., there's a TLS config, we can get some information, there's a DNS request, we can.28:06Get some host name from there and we know where device is connecting to.28:26Earlier we mentioned the smart suites and we mentioned how we basically infuse the firewalling capabilities into the network. So the smart suites is essentially a core part of the hybrid mesh firewall where we just take the traditional firewalling capabilities and we pass them into the network infrastructure.28:33A smart sheet is powered by both an NPU and a DPU and it's basically having two different personalities living on the same applies. Essentially.28:52NPU will do the traditional switching capabilities of, of a switch as we know it. It will basically receive the packets, it will decide where this packet should be forwarded to. While the DPU on the other hand side, it will doing the firewalling capabilities. Dpus are very powerful and basically it will help you.29:01Deploy firewall rules and segmentation in your network infrastructure without actually any kind of impact on the traffic. So you should expect that as a device goes through a switch, the NPU will decide where the packet should flow, but the DPU is the one that's actually doing the inspection based on port and product.29:22So you don't have to think that you need to deploy a firewall everywhere. You can just deploy your micro segmentation strategy directly on your network infrastructure.29:41And, and have the protections closer to the applying to the to your applications. And of course, I don't know how many of you have may have heard about life protect one of the latest additions of the smart sheets, which will help us protect.29:50The net, the Cisco networking infrastructure from new attacks. Let's say there is a new attack or think of the scenario where you read a security advisory and you decide that you need to go on and upgrade several network devices and it can take a lot of time, a lot of planning, you need to plan downtime and.30:06So on. While in the meantime your device might still be vulnerable to those attacks. So with life protect, what we're looking to do, we are looking to.30:26Deploy cartrails directly on the network devices in the form of shields, which will basically protect the device from any kind of attacks, it will protect the control and management plane of the device, ok? We're talking about the network infrastructure specifically, and we will deploy compensating controls until the.30:35Until a fixed release is out, and of course you can also until the time you need to plan your until the time you need to plan for your upgrade and deploying those controls. So it can be a quick and easy way for you to make sure you secure your network infrastructure.30:57Until you are ready to upgrade.31:15Now, the containers, the container deployments have been, as I mentioned earlier in many organizations have been a black box. We usually protect the traffic that comes or goes to a container cluster without actually knowing what is happening in there. How do the different pods and services communicate with each other? And sometimes.31:19They can run also on prem, they can run on the public cloud and it's very common that they create.31:39They they created sorry they create parts of the, they are in parts of the network where we don't know what is happening in there and they create blind spots. So essentially what we do with the use of we can integrate with your container platforms and we can build network, we can call.31:50Figure networking policies as well as.32:06Networking policies as well as micro segmentation policy with the use of Cisco land or with Cisco secure workload. And NO, we just we don't just get full visibility there. We know what kind of spots are running, what services are running, we can configure the rules as they come and go.32:11From a container cluster or between the pods, and of course we can also configure routing in your Kubernetes environment. So we can, We want to make sure that the container environment is security the same way that the rest of the network is secured and that would apply both for the on prem container environments, Kubernetes or opens.32:28Shift as well as the ones that are hosted on the public cloud. Now let's talk about one of the most important topics of the past couple of years, AI security with the proliferation of the AI applications and agents, the need for security posture is changing dramatically.32:48So the traditional application used to have three layers, has the presentation, layer, the application, and the data layer. And this has worked well so far when we are deploying compensating controls and when we try to protect an application. That is because we know.33:08That an application for a standard input should provide a standard output. We know what the behavior of an application looks like. We know what this looks like when we interact with data and what kind of prompts are allowed and so on.33:24However, with the AI application we add an additional layer here. We add an AI model and things are changing because we are moving from a non deterministic to a new type of application that the same input can provide a different type of output.33:42And several types of, of attacks while they still exist, they need different types of cardrails. E.g., if you had a scenario where you were protecting an application against prompt injection, you were protecting an application against.33:59Data loss prevention or what kind of data can be exposed. That is changing because sometimes it maybe difficult to tell how an AI model will behave and and of course attackers are getting more sophisticated, so you may deploy some compensation controls but those compensation controls sometimes may not be enough. So and.34:16Our deny logic is not as easy as it used to be for the traditional applications and testing those applications getting more difficult. So this is where AI defense can come in and play a very crucial role in, which is an integrated part of the hybrid mesh firewall.34:36It does offer three unique capabilities. The 1st one is to discover applications. It can discover the applications where they are hosted and what kind of AI workflows do you have and so on. And then it can validate applications at machine speed. So it doesn't just.34:54You don't visibility is one thing, but you also need to be able to test those applications, and those AI applications are also changing very, very fast. So it maybe necessary to reevaluate, to test again. There's the several prompts, see how the new application, how the new model, the model will behave. So we're doing.35:15A continuous validation of your AI applications, whether they are on prem or even if you're using a cloud based AI application. And of course we can deploy compensating controls. So.35:33As we mentioned earlier, applications are different, so the same type of compensating control we used to have in the past may not be applicable. So we can go on and deploy guardrails infused into the hybrid mesh firewall and we can make sure that those applications are protected while in the meantime we're still validating and we're still evaluating to see.35:44If new guardrails are required.36:04On this slide we have basically a representation of what AI routineing would look like. So e.g., think of a prompt. You wanna make sure that your AI application will not reply back, back to a malicious prompt. And you may need to test the prompt several times. So you may have compensating control.36:07Controller will block the prompt or it will make the AI application deny to answer this prompt. But three factor or even worse.36:26Another malicious application, another malicious model might still try to rephrase this this initial query. It may try over again by taking its original prompt. It may ask in a different way. It may try to give some kind of.36:36Let's say instructions to the model and try to until it gets the answer. So it will continue to keep returning until it gets what it wants. So essentially what we do, we, as I mentioned earlier, we evaluate your AI application, your AI applications at machine speed, meaning that you can rely on.36:52An AI defense that will.37:12Constantly re evaluate and revalidate your models and it will produce score reports that will let you know how many of the malicious prompts were allowed and how many of those were failed and what kind of guardrails are required. Once you verify the guardrails, which you can choose to deploy and you can also review the recommendation.37:14You can deploy those guardrails which are part of the hybrid mesh firewall through AI defense.37:34And then you can be start checking again your your AI models with the existing guardrails in place and see how the model will behave. And this is an iterative process which means that you evaluate, you deploy guardrails, but remember the models are always changing.37:40And they can be attacked by other models, so we need to have the continuous that will constantly keep evaluating your models and will constantly require suggest new guardrails that maybe required. And all of that, it is part of the hybrid mesh firewall. So you can also that AI defense works with the rest of your net.37:57Security infrastructure, make sure we intercept that traffic because we probably will need to have visibility in the payload to understand what is happening and from there we can deploy those compensating controls.38:17And the last part of the 1st part of today's session would be the engine. The mass policy engine is the latest addition to.38:34Security cloud control. And essentially it is a it is a feature that comes here to address concerns. We talked about firewalls that can be anywhere. Firewalls that can be on prem, on the public cloud, your virtual environment, you can protect your Kubernetes environment and so on.38:47And this is where things get complex. Most organizations have firewalls from different vendors. They have different types of firewalls, different versions in in the different environments we just mentioned. We have the new applications which are running based on AI models. So how do we configure?39:04Our firewalling policies. How do we make sure that if I create a rule or if I wanna allow access to specific application will be enforced across my entire environment. So e.g., if I wanna create a rule that says allow certain users or devices to talk.39:22To specific application.39:41How can I know that the same rule will be enforced across the different parts of my network, right? Different administrators sometimes need to come all together and try to identify how we gonna configure those things. So the challenges that the engine is trying to solve is to.39:43Reduce the errors when you build the firewall policy because you may need to repeat the same configuration across several several access control policies, several applications, sorry, several parts of the network, several administrators, so it's very easy to have mistakes. Now the policies may not be.40:02May not be may not align. So e.g., the policy in one firewall may not align with the policy on another firewall. So if I have my firewall protect my users, there are several networks, maybe the public internet in between and there's another firewall on the other side. Those two firewalls they both need to be allowed.40:22Connection to an application for those users, right? So how can I make sure that both of them will have the correct controls to allow the traffic? And of course, as I mentioned earlier, multi vendor environments, how can we make sure that.40:38We can have the same rule on the other platform. How can we tell that, ok, I configured that but now I need to talk to another admin. They need to go on and configure another policy, another rule that takes time, that adds complexity, it can add some mistakes and so on.40:55So with the essentially we built firewall rules in a whole new way. We are building intent based rules where we say, and let's use the example of this slide, that we want to allow access from one application to talk to another application.41:13Now the security cloud control, so it will run on your cloud based controller, and it can essentially create a new rule that you choose where you want this rule to be deployed all at once. So you may wanna choose that this rule will be deployed.41:29All my perimeter firewall in the firewall between different parts of the network and the firewall that is in front of the application. And essentially it will talk to all those enforcement points all at once and it will deploy this new rule.41:46Whether those firewalls are Cisco or 3rd party firewalls. From a configuration perspective, it's not very difficult, sorry, it's not very different than what would you do when you configure a traditional firewall. You would allow, you would choose an allow or the block statement and then you would choose source and a destination and of course the type and the protocol that.42:03Do you want to allow?42:23Just like how you would do it on the traditional firewall. 1st you choose a name and the purpose, then you choose the users and the endpoint access, and then as the last part you choose where to be enforced. Now, has a benefit since it's being part of the security cloud control and the rest.42:25It has the capability in all context. So you should expect that the context that is important by other platforms such as multi cloud defense, which can talk to your cloud providers, firewall that you may have several network objects will appear here. So you should expect that the context that you already know and the configurations you already have come.42:46Still play a crucial role. And once everything is configured then you know what is the intent of your policy, you choose where this can be deployed.43:04And essentially what you have to do, you don't have to spend time choosing what how many different policies I need to update. You just run your rule once and then you pick up enforcement points and that will simplify any kind of configuration.43:13It will reduce the time down to a few minutes rather than just hours or even days and weeks of having to decide all the enforcement points or the different access control policies you need to update and all the different.43:31The different, let's say platforms, right? So every platform may have its own administrator. The key things we need to keep from the mesh policy engine is that it's an intent based policy from one interface, meaning we create rules based on properties. You can of course have the network tra the traditional network.43:47Base rules, but we are looking to build intent based rules. My environment one cannot cannot talk to environment B my users can talk to an application, those kind of things. We can deploy in minutes, right? We write the rule, we say, I wanna allow certain type of traffic, I choose where it will be deployed and.44:07It will take save plenty of time through the integrations with Cisco and 3rd party firewalls. And of course it can help you optimize rules and objects. It knows the context from the rest of your integrations of the, of the hardware mesh firewall, you can reuse this knowledge directly into the mesh policy engine.44:26I'm sorry you activate it and you can start working. Currently, for users who have security cloud control and a cloud delivery firewall management center and 3rd party integration I would like to highlight that this part it is subject to availability. So let us know if you have a specific platform you are looking for.44:46And that concludes the 1st part of today's expert insight series on a hybrid mesh firewall, and yeah, we can take a short break and then we can be back for the next part.45:05Thank you. Next part will start at 1030. Thanks. Yeah, we'll be back in 15 well at 1035 CET time.45:23So I'll put a timer up. Thanks Costas, it's been resumed thank you David. So hello, everybody. My name is Christopher. I'm a customer success specialist as well and I.45:39I'm going to talk to you about.45:59The the new features that then brings to us or in all the announcements, so the agenda for this so we have until 1145I believe, let's get started. We are going to start with the life cycle, a few words about it and the changes about life cycle and and versioning. Then we will.46:03We're going to spend a bit of time talking about decryption and encrypted visibility engine.46:23As well as a demonstration for snort ML, which is Costas has been talking about earlier. And then the 1st point of this agenda is actually a set of of announcements which are touching about the user interface upgrade flow that.46:30I'm going to mention as well about Splunk etc. But since there is a dedicated session about it, I'm not going to dive deep.46:49And then we are going also to talk about the AI ops, the agent, the AI agent and what it is, what it contains, how you can benefit from it. Before there, I propose you a small poll. I hope you can all see this slide.46:58So it's a Slido and you, if you can tell me a bit more about what feature you were looking forward to in the version ten. Normally this slide though will continue while I'm presenting, so if you can catch it, I hope it's visible for you.47:20I don't know if it's visible from the Webex, but if you can just catch the QR code anyway else, feel free to drop the answer for.47:38This call if you are not able to open it, you can open it, you can drop it in the in the chat, ok? But let's get going because the time is flying. So about the life cycle, we are all used to the classic.47:51Versioning scheme that we have known for now since firepower actually started, right? So we have the major version of the 1st number. 2nd number, the minor release use is also an indicator of the type of release, so we have two major type of release long term.48:11Releases which are supported for a long longer time and short term release which we use to introduce new features and that are accessible for the people who want to benefit from, let's say bleeding edge.48:31Features new new things. We had also an extra long term releases set which are because we want to when once they are certified for government government certified vehicles, so let's imagine a release gets installed in a summary is not going to be possible.48:44Between to upgrade it so often and the support needs to be extended accordingly. So that's the kind of scenario we need those extra long term release for and maintenance release and and vulnerability release numbers are just to, to indicate, you know, they are still part of let's say it's the the higher you change the number.49:04Remember the the more changes you have, the deeper the extent of the changes and new features you will get.49:23So that used to be the numbering we had. And in terms of what it looked like in in on the timeline, so we had in the past we had the seven zero as an extra long term release, so you can see what extra long term means, 51 months software maintenance plus twelve months tag. Short term is much shorter.49:3018 months, twelve months?49:50And then the long term is a 36 plus twelve, ok? So that's what it looked like up to seven six, ok? Now, some people may ask why not just go with version eight instead of So the intent behind the moving to the.49:52Two digit number is also to make an alignment it's still.50:12Not completed, but it's essentially make an alignment between firepower and ASA code. So you know that AC has been running version nine point something for quite a while and the intent is to align both.50:17Versioning. So that's one of the reason why we moved to the version ten. And ok so that's the past. So we changed now the way we are going to name releases the obviously the major release. The the concept are the same. It's just the.50:34Those will be different. We are giving up on even odd long term short term releases, but instead we are going to have one initial release here ten.zero is the initial release.50:52With the new features and improvements and then later on we are going to have one final minor version is going to be ten.five and is going to be delivering new features and announcements as well but and that's a version that will be the one that will be certified.51:03So that's now the the life cycle that we are going to have instead of other numbers so essentially two minor two minor release per major release. And then obviously we keep the concept of maintenance release for bug fixes.51:23Is and the vulnerability vulnerability number would be more for you know the critical fixes for critical vulnerability.51:41Okay, so what we will have in terms of life cycle is like looking like this. So we can expect to have something like nine months between each minor version. It's actually a nine month cycle. So we should have one major, one minor release or major as.51:52As it turns out you see that we have, we should expect the version eleven after 18 months following motion ten and then the.five is roughly nine months after the the initial one. And so it means that we should have ten.point five somewhere in the end of 26.52:12Okay, and we're going to talk about touch a word about recommended version, but essentially it's usually the final release of a train that's going to be the recommended one, so.52:29We can say sort of that a major release is kind of the equivalent of the short term in the in the way that it introduced the major changes and big big changes and yeah typically the ten.five will be the one that will.52:44Eventually get its called on star, ok?53:03Now for the supported platform of that version, we have a set of new fmcs, so the 800 what 1010 1800 2800 4800 series is coming up with refreshed hardware. We also have the new firewall 200 series so far.53:09There's a hundred 220 model and then the 6100 series.53:27Which is there to basically take the place of the higher and replacing progressively the 9300 series. We still have obviously 9300 series is not terminated, we still have a set of service modules for it, which are all supported under version ten.53:33You will see that the version 20 the 2100 series and the earlier 4100 series are not anymore part of those supported hardware on the new version. So only those that are listed there will you will run be able to run version ten.53:50And then of course we have all the virtual platforms on prem or on your cloud provider of choice. There are a few new novelties for for clouds that we will talk about later.54:09When it comes to upgrading, you can go to version ten starting from version 7.3. There are some platforms that obviously will not, you know, some platforms are have been released and are not able to.54:26Run let's say we have we have some platform that runs 7.4 as the 1st versions and obviously those will start from there and then there are some.54:45Some specific things about here you see can see the 1200 platforms so it's coming with version 7.6 or higher and the rack month version of 1200 start at 7.7. So those are a bit of an exception. For the upgrade.54:56Upgrading some some platform you know still had FXOS separated the older platform those please don't forget to take care of FXOS upgrading before upgrading the main software.55:15Okay, and then yeah we keep obviously you for those who know about the golden star that you can find in software.cisco.com indicating the the version that we recommend for Greenfield deployment. So essentially there are versions.55:32Is that they've proven their stability and maturity and that are deemed.55:52Production ready for new deployment. That's all for the life cycle and and versioning, so now let's move on to the rest of what to do to the features themselves. So now.55:58This is a summary of the big highlights of the, of the of version ten we will talk about engine and the quick support. We will talk about we will also talk about decryption. It's kind of implied here, but.56:13Encrypted visibility engine visibility engine doesn't decrypt. Well, it does something that doesn't require decryption where Costas also already mentioned it so we are going to cover it again.56:30Splunk the integration with Splunk has been improved as there that will be the next session actually, so I'm not going to delve much into it. We are going to talk about the AIOPS improvements about a bit about the usability enhancements.56:45And the virtual improvements and yeah, I already mentioned FMC and new hardware. So let's move on to the part to the threat and malware part of those features. So.57:01Simplification of if configuration simplification of decryption policies that used to be a bit more complicated app ID is bringing default port support when you select an application and and then we will see how it is configured. We'll run, we will look at it.57:20In a in a lab. So as again this is not something that is very new nowadays but everything gets encrypted. That's just the way it is now, and it also means that.57:40Attacks are encrypted as well when they go over the encrypted traffic, so it means that we stop being able to view them see we cannot see them coming since they are embedded into encrypted traffic. So hence a bit of a challenge there to.57:55To enforce those rules and to block those attackers and so for those who you probably know that since we stopped we are not able to see past encryption, it means that if we don't decrypt or if we don't do anything, Snort will stop seeing.58:11And we stop inspecting traffic typically for an here for an HTTPS connection after the 4th, four 1st packets and what it means is that if we look at the capture, we essentially are able to, we are able to read the TCP handshake.58:31We are able to see the 1st of the client hello. We are catching the server name identity indicator and past that the rest is encrypted in TLS 1.3 and so we that's not much of an information that we can get. So we have some kind of problems now if we decrypt.58:49Then things are changing. Obviously then we can inspect much deeper and then we are able to recognize things that are attacks. Now obviously come the problem that decryption is a cost and we need to be smart about how we.59:10We applied this decryption, but that I'll come back to it when we talk about what encrypted visibility engine brings into not encryption problematic. The decryption.59:28Decryption so decryption policies used to be only rule based and to get started with a rule based decryption policy used to be something of an undertake an undertaking. You, you need to make sure that you have all the rules that you set all your exceptions that so.59:45It it was not so easy in the traditional sense. So that's one of the announcement that.01:00:05Then version ten is bringing. So this is, I wouldn't call it a it could call it a wizard, if you will, but essentially it presents the problematic in in a streamlined fashion and it allows you to get to a working policy.01:00:12Much faster, much easier. We start with the inbound decryption, inbound decryption, protecting the traffic going to your servers, and that's typically one that you are very interested about, you know, to know what is going on there, followed by we will see it in the, in the.01:00:30In the demo is going to be much will we will go about it. So outbound decryption follows and outbounds will be.01:00:50Essentially you are going to define 1st what you want to protect, what users should be as their traffic decrypted, what application should or should not be. So we have a 1st what do we decrypt and then what do we make an exception for?01:01:02For different reasons. And we have additional configurations required for, for the for that part as well. Let's keep that for the demo shortly but 1st what about intelligent encryption.01:01:17The bypass so as I was saying, because decryption is a costly operation.01:01:37We don't want to waste too much resources on decrypting everything. That just doesn't scale. So we use the intelligent decryption bypass. It's a feature that is brings encryption visibility engine will allow us to get an idea of what kind of traffic.01:01:42This is what application is it coming from? So what what what process initiated that that connection, and from there we are able to establish.01:02:02Whether or not it is worth it. So if allows us to establish a risk score for every connection and then we might find that something is coming from a well known process, a process that is usually involved is something we don't want to have anything to do with.01:02:13And it's going to be considered a high risk and we are going to block it. We don't even need to decrypt that. We know.01:02:33It has nothing to do there. And that's typically a fraction of a percent of the flows, so not very much. So we don't save so much resource doing that, but it's already something out of the way. Then we have medium risk.01:02:39And then ok we have low risk as well. Low risk you see constitute most of the flows and if we are able to recognize them, then we can avoid decrypting all that bulk. And you see we save 96 % of the.01:02:55Resources necessary otherwise to decrypt them. Then that leaves us with the medium risk with three to, you know, a bit less than 4 % of the flows that then we are, we are going to spend the the energy to decrypt and and inspect.01:03:10So that's the idea with the intelligent decryption bypass, and you will see it's very, it's it's very straightforward to activate. So encrypted feasibility engine, we are talking about it. What does it do actually? The way it's doing to establish this risk score.01:03:30Is true fingerprinting. So we'll see the idea is that once we are, we are able to determine with a fairly high amount of probability because there is never hundred percent certainty, but we once if we are let's say we are.01:03:50Probably with 99 %, right? That's already something, you know, that we we can.01:04:10Establish the risk with a high level of confidence. So the way the TLS, the way this works is that every process that will initiate TLS that will proceed with the TLS and check will have a.01:04:19Specific fingerprint.01:04:38And due to that, so if we look at that part that we are able to read and the order, the, the, the type of cipher that we are listing, the the order in which it is presented, we can match so we essentially we built database with all those in those TLS fingerprints and that's allow us.01:04:42To, to recognize what, what is the process initiating the, the connection. And then we obviously have the destination context, so the SNI tells us where this connection is going and combining those two things, so obviously we have reputation based on the destination. Now we can also verify and validate.01:05:01Whether or not the the combination of the source process and, and the destination context.01:05:21Gives what what kind of risk do we have, and that gives us a better idea of, you know, if we can go with this or not. So yeah, we will see in the demo, it's essentially ticking a box to to enable if we have essentially two modes pro monitor p.01:05:29Protect protect will block monitor will just.01:05:49Tell you, and then a few other things that are that you can that that's the old way that it used to be configured, so it it looked a bit more complicated than it should be and now it is a bit better. So now let's move to the demo. I'm going to slide.01:05:51To the firewall.01:06:11I hope you can see it and it might take a bit of delay but so we we do have an FMC here and the maybe before we just a moment, I want to show you just quickly the topology, so we have that this is a classic.01:06:13Topology from the cloud lab and for if encryption demonstration I'm going to focus on the firewall name firewall, which is responsible for East west traffic, and that's where we are going, we are going to turn it on for everything, but that's the 1st part here.01:06:33Is going to be there. Let's come back here. So to turn this on, we are going to head to application control.01:06:50Oh policies. All those the campus firewall here, the, that that's the one is under apparent policy, so instead of changing it directly in the policy, I'm going to.01:07:06Change it in the parent policy and it's going to be inherited. The place where if is living is just here and it used to be kind of buried into advanced settings. Now it is just a box that you tick and the interface opens.01:07:26And we're going to set protect and we are going to just leave it with the default settings. Saving alright now.01:07:45We need to deploy this. Let's just go on, yeah. While it's deploying I just want to show you quick that essentially, we don't have.01:08:01Much visible at that stage, we are going to select what comes from.01:08:18You shouldn't be able to apply this. I hope I didn't didn't make any typo. I probably did. We're going to do it differently.01:08:36Just yeah, it's so let's just add inclusion to filter. It's easier like this and then we can just select, we will obviously have connections for sure but yeah and ok that's been going very fast actually.01:08:59I think this deployment went faster than I saw, but you see that before there we had zero.01:09:17Visibility for the each fingerprints. So these columns that you see there, I have been enabling them in the interface, so if you just type here, you are able to take the e fingerprint and process and et cetera, so to threat confidence and the score.01:09:24Are visible from there in those columns now, and you see that after I deployed I start seeing steps so we have the process confidence. So that's the certainty of which we are able to determine the.01:09:44The nature of the process talking and then the threat confidence is here. We see very high and we see that it was blocked by EV, ok? So.01:09:59That's essentially that difficult to turn if on. We will change this now that we are done with that part, we will change with this, the others we are going to enable the decryption policy and.01:10:16We have a quick server, let me see, sorry about the swap. I hope it's not confusing too much of Webex, but for 2nd demo we are going to focus on this firewall here where a server is hosted on the corporate side. It runs, it's a quick enabled web server.01:10:36And it's going to be contacted by this workstation outside to download the file that is on the server, but that turns to be infected, and so again a bit of swap. So I'm on the workstation.01:10:55The quick server is a link on the Firefox and if I click here to download an test file, so the special test malware file made to be not dangerous but and and used to, to.01:11:16Validate that detection is working fine. So it went ok, not a problem. It didn't get blocked or anything. And now if we move to.01:11:36I'll see what has been going on so I will select the IP address of this server, there we go.01:11:47We should see that connection and we should see the level of we just refresh this timer because it tends to be, that's the the fun of obviously the interactive demo sometime a bit so lower. So.01:12:06So the the client is coming from this this address and if we open this here, we can see.01:12:26The level of of visibility. So it is a SSL protocol. We don't know exactly what it does. It's from the web firefox. It's it's so that if if he's doing his job by identifying the process. So we see here the.01:12:34It's highly confident that that of about the process but it is very unconfident about the threats essentially, there is zero confidence we we are not able to see. You see, there are actually here seven packets inspected.01:12:52Only on much many many more, ok? Now now let's let's turn on the let's create a decryption policy. I'm going to create a new policy and going to call it EIS.01:13:10Okay, so this is going to be the new, the new layout, the new interface. So we're going to hear the the demonstration will touch inbound decryption not outbound, and we are decrypting.01:13:29That's the destination, so in zone one is the destination server. Out zone is the source and we will tell it that we want to decrypt things for.01:13:46The quick server. What you need to have configured in order to do that is the certificate and key private key and public key which isn't certificate of the server that you host, so.01:14:01Normally you are able to get your, you know, in position of that, you need to create an object for it, and that's this object in internet certificate object. It contains both and you put it there and that's all you need to do. You don't need to worry about destination port object. It's optional and anyway.01:14:18Now let's quickly have a look at the outbound decryption.01:14:37Outbound decryption, you see here you would also specify which zone source and destination you want to subject the decryption to. So for traffic coming from inside and from inside you are able to determine from which zone or from which users you want to apply.01:14:41This description?01:15:00You will need to set as well an internal certificate authority trust so so that's what will be used to, to play essentially man in the middle on behalf of your users decrypting, you know, and re encrypting the traffic between so that we are able to look at what is going.01:15:02And in the bypassing on the in the exception so you can set.01:15:22If you need, bypasses per source destination or users, also the type of URL, so for confidentiality reason, e.g., you might you out of the box we get an exception for because it's a private nature, and.01:15:27Yeah, you can also have a non undecryptable application. Let's not waste time trying to decrypt what cannot be. What we also want is usually when with when you do outbound is intelligent encryption bypass, so that's how you do it.01:15:45It's see super simple. You can also decide to block connections that are not part of those those algorithms that you still want to be seen on the network and.01:16:01Important thing as well, so here are additional settings. If you want to do this, you may, you must make sure that you add your, your CA, so the issuer of the certificate of your server must be as well.01:16:18Part, yeah, you have CA, that's the issuer of the server certificate that we want to use. So if it's missing there and important as well enable quick decryption, that's a new feature. I didn't say what quick quick is, but for those who don't know, quick is an evolution.01:16:34There was a there is often a problem when when when you try to download so I'm going to turn this off. When you try to download the resources from a website on on an unrealable network and packet gets out of order or some packet gets dropped, you get delays because TCP stack doesn't want to.01:16:56To proceed further.01:17:13Until you know the the out of order missed packet is retransmitted, so what's quick is it's we move from TCP to UDP, we integrate TLS 1.3 as part of the protocol directly in the 1st packets, and we take a streaming approach.01:17:18Instead of a connection oriented approach. So doing so, we are able to.01:17:35Make it faster essentially. So that's what so a quick session will contain multiple streams. We will download multiple objects, so that's a bit different from the approach with a TCP oriented well we can still keep multiple objects in a single TCP connection but it's it's a different way and It's, it's it's not.01:17:42The new is what HTTPS tree works on. So now that we have created this decryption policy, we need to apply it to the ACP.01:18:02Oh, I'm going to do it here and there apply. Otherwise we can also get it. Yeah.01:18:12We have to save, and it only shows after saving quick look here. So in the London ECP which the one is on the firewall we are running things on.01:18:30And before we waste too much time, I'm going to start the deploying there, ok.01:18:48I went too fast I think. There we go. Okay while it's doing that the policy we we are looking at is so mostly this is the the rule that has go is going to be matched, so it has a file policy to block malware so far it wasn't successful because of the lack of visibility for it and.01:19:07And so we see that we inherited decryption in the policy, so we are good, very nice. Still deploying time is really flying when you do demo.01:19:27Oh alright so now I want to, I will just start the Firefox again just make sure I hope the Webex is.01:19:47Letting you see this and download the file again and I'm not going my not getting the file anymore.01:20:01Okay, that looks like it's working, yeah? Now we should see this, right? Source and destination or sorry.01:20:18Cannot be and apply.01:20:33Yeah, and we can see what has been happening, so we just take this one e.g..01:20:53So we can see that the decryption took place successfully. The file was blocked. Well, something was blocked for sure. It doesn't say file but think that it just blocked the the action in in yeah it was a file sharing.01:21:03And there if we look at Eva I think we will see something or where is it? Where is it, where is it? I think yeah I didn't catch the right thing to see if because this is more of the quick stream. Let's look at this event here.01:21:21There maybe.01:21:41Nope, it's not going to be it's sorry it should be that just what wanted to see. So yeah, we still have a low well actually it makes sense, right? Because this is a lab server.01:21:44This is not a known so as such the connection itself has a low threat confidence. So it's only because we are decrypting.01:22:02So we, this is the inbound traffic, so we will always decrypt, so there is NO, it's not subjected to intelligent bypass. It's only for outbound traffic that we are going to do the by the intelligent bypass. But for this we are decrypting for sure.01:22:13And we are successfully blocking the file that was otherwise hidden into the encryption, ok? All right, so let's get back to our presentation because now we can move on to talk quickly about.01:22:32So has been talking about it already, but essentially we we are unable to match signature for things that have never been seeing before. And this is why we want to.01:22:49To be, to apply let's say machine machine learning and a neural network to recognize what look like something suspicious, something that is has all the characteristics.01:23:05Not from applying a signature, but from applying a machine learning to it. And then we are able to spot it. Okay, that's the idea. Now we are going to look at how this is, so at the moment.01:23:22We are having a SQL injection protection that was set in 7.6 and HTTP command injection has been added in FTD 10.0. The demonstration though this is the flow essentially so the we need to enable the inspector that's part of the network analysis policy.01:23:39That will catch the HTTP traffic and feed every all HTTP data into.01:24:00The neural network into the the process. It will be classified, assigned a score and taking action upon based on the results. So how this is set up, and we'll show you here. So we are in the context, this is pre recorded demo.01:24:06We're in a context where we have, so this is the client machine and it's going to access the server that is behind that firewall and you see, we have a button here that.01:24:26If we inject some we do an injection things not don't know if it's an SQL injection or something else but anyway, the the result is that we have messed up with the page and the button is now, well, it's just the demonstrations just to show that the.01:24:42The injection has worked. So now, on the firewall, we are, so this thing is done in the intrusion policy. So.01:25:00You will use your intrusion policy and you are going to overwrite the specific rule that is using, it's a GID 04:11 from top of mind if it's not 441.01:25:15So we are going to filter to find this this specific rule is for eleven, yeah. And that rule we need to change the default action and set it to block.01:25:34That's the 1st step. Afterwards. So we are in prevention mode as you can see. Afterwards, we need to modify something in the network analysis policy. It's important to have it, so it's not version three. Don't worry about, so if you know what you're doing, the warning is is not.01:25:55For you and the way you enable this is you change this in JSON configuration to true. Normally you should also set client body depth to minus one to avoid stopping at this this the 1st.01:26:14And we are so the deployment of the policy is going to take place now. I think we can actually speed this up a little bit. That's the charm of recordings.01:26:35Oh now that the deployment has been done, we are able to return and try again, and click here.01:26:54And now try the injection attack and we see that basically we are not able to get through visibly. So the server, the, the, the connection has been halted.01:27:12In its slide and now on the firewall, if we look at the events unified events, what has happened?01:27:28So we see where we have one intrusion event, it has been blocked, that was to that server. And if you look at the details, we can see that the snort ML is indeed.01:27:51Responsible for this action, so it performed its purpose through the the signature, the rule that we enabled. Okay, that was the demo for this.01:28:09So now we can return and continue speaking about all the other features. Let me return the screen where ok actually I'm still here. It's good so we can move on.01:28:26Just to mention because that was not part of the list of things, but it's not a small feature announcement so as the one is will be discussed in detail tomorrow and essentially you are able to deploy.01:28:47Tunnels between your branches and your s your your your main had your main network in a, in a very easy way and the new features such as equal cost multiple paths and bi directional feed forward the detection.01:29:03Are in an addition to make it possible to.01:29:23To get tunnels over redundant service providers detect the faults very quick and switch accordingly you know adapt the routing to, to any change of reachability and when the tunnels is failing so that your redundants do its job properly, but that's all I.01:29:28They will say about it so we will discover it tomorrow.01:29:48For the management and upgrad upgrade, so Splunk integration again this is not one that I will dig deep because you are going to hear about it just after I'm done here. There is a navigation navigation simplification of the firewall.01:29:52In general, there are some enhancement advanced logging for application specific events and the upgrade will see that the flow has been made, it has been made better and some migration are also helped.01:30:10S when you remove from an old model to a new one, there are situations where it has been made simpler. But let's get going with the slides. So this is about the navigation announcement that you can see here. So if 1st you can customize.01:30:28Your navigation easily, you can keep your menu, you know, just the one that you use and not the rest if you don't want and.01:30:46Here again, you can, you know, set up your menu for your profile so that you are more efficient getting where you want. I think that's shown here. So that's.01:30:56You can of course always search when you don't find something and you can switch the dashboard up to what you want. Yep, so about the configuration of the integration, so this is the.01:31:13Quick glimpse on the, the setting up of this integration it has been made as well into a.01:31:33And easy to configure screen that you can easily put into action and you get something that used to be you you needed to have e streamer etc. Now you you can get these things through this direct integration.01:31:40Again, then you will hear more about this might be jumping forward NO about the upgrade, so that's the new upgrade interface and improved where you see that you have different.01:32:02The Elements that have been added. You are able to see.01:32:22The state of the different devices that you you want to upgrade, so if they are in the compatibility and readiness check or if they are already being upgraded so when you do your upgrade of HA pair, they will be processed in sequence to keep, you know, one at a time.01:32:27You have details visible for each device that you are, you, you have selected for an upgrade and you can follow the progress through this interface, so that's the way that the upgrade has been improved.01:32:47To make it an easier experience. We'll see that there are some AI things the AI agent that can also help manage upgrades and select proper version, the one that you want. So the workflow, yeah, there, there are things that have been moved separate so you can you.01:33:04You see that you can tweak the behavior of those upgrade flows to e.g. fail when there is an upgrade you don't, you can keep going or you can decide to to stop where you are enable the revert and if you want to impose compatibility and readiness check.01:33:24Before you do proceed. So still in the upgrade, so you see that you can yeah monitor the detail of a device from this this screen you can see everything that is going on.01:33:44So that's the making the experience better. Now I mentioned the migration support. So some device for some device, not everything because again, the idea is that usually when you want to migrate from an older model to a newer one, you usually stick to the.01:34:04The level of, let's say you you will not it's very rare to upgrade from an entry level to a high end 6100 e.g. but.01:34:24For migration within, let's say the same level of appliance. So here you can see that we we support migration for the 4100 series the the following model and the service module here. You will be able to export certain elements.01:34:35Of your current device to the new device.01:34:55Instead of having to do it again. So the interface configuration et cetera, those things they will be, it will be possible to migrate them in a smoother way so making the migration of your devices easier. And again, some devices don't go.01:35:00Beyond seven.01:35:19You, you, you may need to do certain step of the grade on an FMC seven.six if you are on an a model that is not supported on an FMC ten. So those models listed in the bottom of this slide, they are not there will not be.01:35:22Be Manageable from FMC ten. So you you need to make this migration.01:35:41Before moving your FMC to version ten, ideally as you will have to do it old style if we, we can say basically configure them from the beginning.01:35:46Okay, so and improvement for public and private cloud. So let's see what we have new and this is all summarized into this. So, the different platforms are bringing different things. So on the google, google cloud platform, we have now.01:36:03The support for the clustering with auto scale for ACV so it's not strictly speaking FTD but.01:36:23That's the improvement that comes with the currently so the naming of the version is still nine point 24. That's the kind of the sister code on ASA that goes along with the release of version ten. So we can expect that in a later version later release we will have ASA.01:36:31Sometimes. On Oracle Cloud infra, we support now arm based IACV and FTDV instances, so we are able to run those.01:36:52Those products on ARM platform, arm based platform, and not just Intel based. We have the DPU acceleration for ASAP and KVM I see. And also.01:37:07Yeah, we have a new tier, a new, a new license for FTDV, there used to be different sizes, but now we have an unlimited which means that we can expand beyond the classic size. So if I can show you a slide about this.01:37:23So, we are now it is now possible to deploy with this tier. It's now possible to deploy typically, on KVM it's going to be a 32 core, 64 gigs of RAM or a 64 core so 120 gigs of RAM, so we.01:37:43It's essentially for the scenario where you need to go beyond the 16 gbps rating of the FTDV hundred.01:38:00So with this, you can go, you can allocate much more resources than it used to be. So technically NO limits, but these are the the classical size that are coming.01:38:09With the OVF templates. Let's keep going sorry yeah now we are going to talk about the AI ops agent think ops and cost Constantinos have been mentioning about the policy analyzer and optimizer notably. So.01:38:25For all those things, the requirement is to have an integration with security cloud control, so you would have to have something like either fully managed from the cloud or an hybrid deployment. So you manage your firewalls from your FMC on prem, but you integrate it with your.01:38:44Every secure cloud control security cloud control, and then you can benefit from these add ons. The one the policy analyzer and optimizer is available for the on prem FMC.01:39:05And I believe that the rest of the, so we will see different things. The rest is only available from security cloud control. So let's go see what this policy analyzer and optimizer is. So the idea is that you, you will be able to.01:39:21Who, to, to optimize your your policy sets, your your rules through this this agent. Let's I have a few examples of what this includes. So, notably.01:39:41It will go give you summary insights of the policies. It will highlight you configurations that you you don't want things that are unusual or expired conflicting. So things that are, you know, obviously not making sense.01:39:56When there are conflicts between rules, it will be it will find it for you and it's going to find overlaps and inefficient policies. So what else do can we expect to find? So the rules that are.01:40:16Fully shadowed rules, which means rules that will be blocked by a higher priority. So they should be removed, they can be removed so you the the smaller your policies, the more efficient they will be. That's the idea. And then if you have redundant rules.01:40:32This agent will also point you to them and propose you the actions, ok? So you have, you can delete them or you can choose to disable them.01:40:48Okay, expired rules for people who are using time based rules. So again, it's about cleaning up, about not keeping things that are not needed anymore. You can also merge rules that are redundant and you know rules that can be merged, this this policy.01:41:04Analyzer and optimizer will point you to them and make your life easier. So in very large rules, overlapping object as well as classic, you know, you may have.01:41:24Objects overlapping each other and you can merge them into a smaller set of objects. So that's the for the policy optimizer. Now, there is also this AI ops can bring you best practices and recommendations. I'm going to go a bit faster.01:41:34Because we are nearly at the time and but don't worry, this is going to be part of the shared slide later on. So this best practice will highlight you anything that goes out of best practice in your configuration and give you recommendation to address this. So it's kind of a almost like health check.01:41:54And so you you can benefit from this from security cloud control. Again, yeah, making some diagrams to show you what has been found and making the recommendation visible and actionable.01:42:14For the feature adoption, it's an assistant that will allow you to see all the different features that are available on your platform and show you a state of deployment, a state of use using this feature or not using this feature, and it gives you an indication of how much of your firewall you are benefiting from.01:42:31And showing you where they are.01:42:51Places that you might want to, you know, you, if you're interested in those features, then you are able to, to drive things in that direction. And he's going also to give you recommendation for each of those for resources that will help you on the way to do so, right? And of course don't hesitate to contact us for, for.01:42:54For our services for, you know, to have a session with one of our CSS to help you.01:43:14The upgrade planner, same spirit in the sense that this is going to help you compare your current state versus the newer versions which are the vulnerabilities that might be existing.01:43:21Orph and fixed and to choose between, you know, multiple possibilities which ones should you should you take? Which one is the recommended version? So that's a way to manage your upgrade and to plan them. So again, you, you can have a detail of all the different versions that.01:43:37That are options, see the list of different vulnerabilities present in each of them and and make an informed choice. End of life planner, not software but hardware here. So what are your platforms that are needing a refresh?01:43:57Find them easier so and so again here we see ASA so that means that they would be inventory into secure cloud control and you are proposed with the best the possibilities for replacement based on throughput, based on the capability of the old versus the.01:44:15View that we propose. That's yeah, again, an offering in the security cloud control.01:44:35And I'm done actually with the presentation almost on time, 1 min later. So thank you very much for following this presentation and I'm ending the presentation screen back.01:44:43So I think we will have a break of, probably David you can help me with that to have a break for 15 min so ok yeah so we come back in 15 min. I'll set a time up.01:45:03Yeah. And so yes, the next next topic is around about Splunk and Splunk integration with the secure firewall and the the management centers.01:45:20Be cool. Excellent. Cheers Christophe. Pleasure.01:45:37So we already touched today earlier on some of the key points, so that's why I actually on this slide put the telemetry into gold, so to reframe your attention to them.01:55:01And I want to tell you something about why we call it enhanced telemetry exports. So before ten.O, syslog suffered from a converted configuration path and lack of parity with the streamer for event types. So in ten.O, syslog configuration is.01:55:14It's greatly consolidated and simplified.01:55:34And new types are added. So advanced logging as well makes an additional improvement to log export and deliver granular protocol specific logging to sims. The FMC UI was being improved to be more navigable, customized and closely to what we have on security cloud control.01:55:36So as you notice probably during Christoph's demos, you already and if you already touched base with SCC.01:55:56You can see that the new interface aligns accordingly to what we have on the cloud to make it easier. So administrators will also enjoy those improvements during the, the integration for, for that CM consumption.01:56:03What we also did, and I will cover in a few minutes, would be we streamlined the syslog integration. So there will be a new wizard that greatly simplifies the syslog integration, that either this compatible with Splunk on day one, other.01:56:21Seems should check with their vendings regarding the the ingest, but it doesn't stop there on Splunk only. There will be new event types that are now added to the syslog that moreover touch on intrusion event packet data and retrospective events.01:56:39And that's pretty much it in terms of.01:56:59Reach telemetry innovation ok for what I mentioned about.01:57:03Doing Splunk in 60 s and to do a quick and fairly accurate representation to what, what Splunk is because people might be using Splunk for many many years as their seam of choice and.01:57:21They may have an idea that Splunk is just logging. It's just the same like so I have Splunk and Splunk is just the same I just do like my my Sim operations with Splunk, but Splunk is actually more than that.01:57:40To do the fair credit representation to Splunk. Splunk is a data platform that can be used for searching monitoring, and analyzing machine generated data. So literally, we have logs, we have metrics, we have events, and telemetry virtually from any source.01:57:56It can be servers, can be applications, can be network devices, cloud services, security tools, and even IoT. And the core idea is we ingest all that raw data into Splunk.01:58:15We index it and make it searchable in near real time using our own query language. So the one query language that exists for Splunk is called SPL, that stands for search processing language. That from there you can build super customized dashboards.01:58:32Alerts reports, and visualizations. In top of my head, it can be primarily used for three things and I'm gonna give an example for probably all the operations that are important, in a company. So 1st of all, if I talk about.01:58:51Clouds.01:59:11IT operations. It's very important for monitoring infrastructure health, troubleshooting outages, and tracking performance. So that's pretty much kind of like KPIs that IT operations are mostly interested on and you can create those dashboards.01:59:12To reply in time to those and then even ship information with an additional platform for ticketing service, right? Like for instance, top of my head, if you can utilize the integration combined with snow or ServiceNow.01:59:32You can then get the reports there and then go to Splunk, verify the data that is being ingested from, that is being forwarded to your indexes, go to your search, get the idea as an IT operate operation. In terms of security.01:59:48As the CM itself, Splunk Enterprise Security is one of the living CM platforms that is used for threat detection, investigation and compliance. I'll be touching a bit more on Splunk enterprise security under my demo.02:00:04Just to know that Splunk Enterprise security is more kind of like a premium paid offer from splunk's side. I'm not gonna cover yet today anything related with Splunk licensing or anything or anything. The core focus is mostly around the integration between Firewall and Splunk.02:00:22Just as a note, and the last one would be observability and business analytics as the 3rd type of what I mentioned about three things, application performance monitoring via Splunk observability cloud, and you can then tune operational data into business insights. So you can have like.02:00:40A dashboard that reports your business gains and everything and then have all the time this dashboard that is giving those metrics. But that's not the point today, even though then you can have the AI driven workflows and everything.02:00:58The point here that I want to stand is how we can then move this conversation into having Splunk being part of a network resilient model and what then we can benefit from having those two platforms integrated.02:01:14So when we are combining Splunk with the Cisco portfolio and how we are thinking about advancing our digital resilience, again I talked about three different key points. So, for instance, when both of the solutions are integrated doesn't.02:01:35Doesn't Matter which part we are talking, if you are talking moreover about operations on the left side or more about threat detection on the right side, and then combining the data from external data sources. The main idea here is.02:01:55For instance, if you are talking about network monitoring, Splunk then becomes part of the network infrastructure and becomes a distributed detector and enforcer. You get insights from across infrastructure and applications.02:02:09Either they are cloud native or three tiered up or somewhere in between, we help to identify potential issues even before they happen and improve the real reliability. And then for the security teams, we have means to provide enforcement tools to complement intelligence and assessment.02:02:24So it becomes, again, a way as well as distributed enforcement where you can, have.02:02:44Automated remediation. Of course this is also agnostic itself, so Splunk itself is agnostic and it keeps working well with other vendors and data from other sources. This is just an example on how we.02:02:51Do operations combined within Cisco. And the main value of all of that combined is to bring together data and insights across all these three domains together and take the appropriated actions.02:03:08We'll see moreover the right side today and more and moreover related with firewall itself. So Cisco secure firewall. And taking that all that information that you got for at least the last five to 6 min around Splunk, I think.02:03:25Think I already scratch a bit your head in ideas of.02:03:45Why you should do this integration? And I just have a few. I'm not gonna go deep deep covering everything. It's more over what stands on the screen to you, but the main reasons that you potentially may consider like this integration to be.02:03:48Viable or want to deploy it is you get to have a centralization of your security logs. So in case that you have, you want to centralize firewall logs alongside the endpoint identity and cloud data and you are already logging that to your SIM, it might be a good.02:04:06Indicator to do this integration. On top of that, if you want to unify everything for security correlation, you are, if you think about what we saw in the previous slide, you are able to unlock the correlation across the entire security stack that you have and that you are at the same time.02:04:23Potentially integrated with Splunk as a receiver of all that data. You may have as well a data governance strategy and you may want to have a long term retention for comp compliance reporting and forensics might be the case that you need to keep that data longer even this can.02:04:43And you may are storing that into your Splunk cluster or you're just your standalone deployment yes, might be one of the opportunities to do that. Maybe you are logging.02:05:03And we can see that in a bit as well in the demo, maybe you are logging out the data as well to your sim. You can also log out the data from the firewall into the same if possible. And last but not least, and I think the most important.02:05:15Is to give power to the SOC. Empowering the soconomist with the defined dashboards and and search gives them the time that they need to be quickly proactive into making sure that we are analyzing the signal.02:05:31And forgetting all about the noise. What matters the most is what's happening that is critical, needs action. I have a ton of alerts that maybe are low fidelity. I want to make sure that I want to have the data correlated that I have.02:05:47And I need in hand and I'm able to pass that information across teams. And with that said, we gonna talk a bit about secure firewall logging, all the options that exist on secure firewall.02:06:03That's been there for quite a long time and to begin with, to which target audience you want to present them. So, because we are talking about Splunk as well, I want to shift your brain into personas, and just to give you an idea what, which personas might be interested in.02:06:20In certain type of events that come from firewall. So if we start from the top.02:06:39And I think they are quite important as well to be part of NetOps and secops. You have ASN FTD syslogs that moreover are important for monitoring and troubleshooting the FTD that are important for NetOps and secops.02:06:46Then connection events detected by the firewall threat defense that interests to other personas including incident responders. Intrusion detections that are detected by Snort on FTD moreover will go to secops and incident responders and.02:07:02Front line then for more forensic investigation, same goes for file and malware. File and malware traversing the network is usually interesting, even if you have to escalate it in your SOC to a tier three for more deep analysis and reversing maybe of that malware sample if that's the case need be to be.02:07:18Need to then store that information somewhere user activity because I think that we talk a lot is, user and identity behavior analytics, things that change over time activity that changes from the user perspective, it's interesting for all the personas.02:07:38Network discovery changes that happen to hosts within the network and correlation events Moreover those go for secops and IR. So this is where we kind of start to put our hats on and how we define personas and how we define events.02:07:59Times to be.02:08:18Moreover of interest of such type of persona. Now, like I said before, from a long time, from a long time, even before, right? Anything still under the seven train, 6th train.02:08:20We get to grow and get familiar with the streamer from a long time. Estreamer exists in secure firewall for quite some time and what I decided to do was to lay off here the logging options that we have from the.02:08:40Most difficult ones/work overhead/the way that you need to put everything in the network in order to make full use of extremember, for instance, to the simplicity that is nowadays the syslog. So we have.02:08:56Being like one of the most difficult ones to operate and I'll tell more about it in a second to the legacy syslog that you deploy as platform settings on your ftds to then to the integration that we will then cover later on.02:09:16In the way that we can facilitate and simplify your life if your plan is to log data. So let's start, let's start from e streamer. So.02:09:34The streamer is only available for the on prem FMC and what is important here from the streamer is that the logs are sent from the FMC itself. And you can already see.02:09:49Quite of the problem I would say, if you think about it that FMC is acting as a server, that means that all the firewalls being managed by the firewall management center will be.02:10:05Sending their data to the FMC and the FMC being the only point of contact to Splunk. It's a proprietary protocol launched by a while back. In terms of performance, it has worse performance than syslog.02:10:21Even though I know someone will ask in the chat and someone will say yes, but it has a few more event types that you don't cover on the legacy syslog. That's correct, yes, we don't for instance, do packet information on the legacy syslog.02:10:38That's correct, but we are also planning to discontinue the e streamer on the version eleven.o, and this is why, why we'll continue the talk today mentioning that if you didn't.02:10:56Done this integration yet. You are in greenfields within 28 for logging or you are just a new customer to ten.O or you are in kind of this transition cycle. It's a good idea to start to approach that transition and to start fresh from the ten.o.02:11:15Syslog and move from there, yes? And now I'm gonna give you reasons why why as well we decided as a company or Cisco secure firewall view that thought that is a good way to discontinue it. So if you think about it in, in the past.02:11:34It's really, it's really intense, so it's the complexity and the resource intensity for event qualification is quite a bit. You're gonna get infrastructure overhead when you have the dedicated service for high events. So back in the day you had to deploy the n core server to receive.02:11:55The events and then forward them to Splunk. We also thought like.02:12:15People shouldn't go through all this hassle and we decided to we have this desire to simplify and streamline the integration moving over for a syslog based ingestion for better scalability and to reduce your complexity of deploying this and also because the new Cisco security cloud app offer.02:12:21Is in us integration and native support. So there are quite other reasons where.02:12:40It makes sense to do this migration, even though you probably already saw that on the Cisco secure cloud app, we will see that that on the demo as well. There is still the field for a streamer. Streamer is still comfortable to, to be done there. But the main reason is because we still have.02:12:46People that didn't transition, which is probably quite a few of the installation base, that can still benefit from utilizing if they are already from a long time using a streamer. They can still benefit until.02:13:07They do the flip and then the application continues to give, give you the support. So in that case we as well reduce the amount of work that used to be done in the past, even for the streamer complexity by allowing you as well to configure like just the streamer from.02:13:23Firewall side to the splunk side in one go without anything in between. This is the other one that exists for a long time as a legacy syslog.02:13:43It's configurable on both platforms, on the delivered FMC, cloud delivered FMC that we will see in a bit on Cisco security cloud control and as well on the on prem because those logs are sent from firewalls. So.02:14:01No matter what, these will be deployed through platform settings is a configuration that is applied directly to the firewall itself, and it will be then applied to the device you will see per device this policy is being applied, you can select which devices will receive this policy.02:14:18It's an again when you are talking about we are talking about doing used three standard protocol. It has better performance than the streamer. It does as well unique log types that can be selected within the.02:14:39Syslog settings and all the logging setup that can be done around that. Like I was mentioning before, it's missing some functionality like the IPS packet data that I was mentioning.02:14:55It is a bit complex to configure, so that's why he's in the middle, but not so much as the streamer, but there is a guide and I, as well in the end of this session have resources to guide you through that journey.02:15:11And it's not recommended for version ten.ten plus or so anything that will come from ten.O nowadays that will launch ten.O and upcoming trains is not recommended because we just launched the syslog ten.o. And if you are talking about syslog.02:15:28As a new feature, why use the legacy one? If you want to get the visual representation how this looks like, I have here a slide, this is moreover for just visual representation and as well to highlight you that with the asterisk.02:15:45Some of that data is missing and we'll see in the next slide. But you get the idea that the firewalls are being sending the events directly to Splunk so the FMC doesn't have a saying here, you can configure it directly.02:16:02On the firewalls, the firewalls send them. Again, like I mentioned, cloud delivery FMC as well integrates with Splunk. You just need to configure your target there and make sure it's reachable and having your syslog being, being sent.02:16:18So let's compare now a bit of what data might be missing from these two specific ones. And if you want, you need any further reference about what data might be missing, I let you hear a reference. So in case you.02:16:39Have access to previous Cisco Live information. You can always go to VRK Sec 2124.02:16:59It still stands today as the difference between e streamer and legacy syslog. So as you can see, as you can see here, the estreamer.02:17:08Covers all the event types and the legacy syslog mrs. quite a few, yeah? So for instance, you're not getting anything from discovery events correlation and impact flags, as well as metadata from intrusion and malware.02:17:24So this is quite the comparison between the legacy and the streamer. Now the innovation, yeah, so the the last one that I want to cover, before we touch the app.02:17:43So, this is the innovation that we did for the ten.O And we have the this new simple wizard that We'll in the demo that is configurable from the on prem FMC and the call delivered FMC.02:18:01It's easy accessible by going to the integrations and just select Splunk from the sub menu. It supports sending events over encrypted UDP TCP or encrypted TLS. You have the optional certificate configuration.02:18:19You can customize the type of events, so you can see here on even an image where the source is coming from, so you can customize if you want everything or the security events and from where the source origin comes from.02:18:35You can create multiple profiles, so as of now as a limitation as well, you can only create up to 15 profiles per domain. Also keep in mind to you don't want to create duplicate profiles for the same devices because it will.02:18:50As well resulting duplicating events being sent. It's completely recommended for new deployments to use this one instead of e streamer, mostly because of the improvements that we did and enhanced logging capabilities.02:19:07Now we are including with this new format intrusion packet data, so what we mainly wanted to do with this log is to create parity between e streamer and syslog. So we are close to close parity.02:19:25Trying to reproduce everything that used to do into this log. Very important things here as well, this part, this part for the this wizard in particular.02:19:43It supports as well integration with with any other compatible CMs, not just Splunk. Keep in mind that for instance, for Splunk we'll see in the demo. We are sending the data in jason, but this is also compatible with CSV, so comma separated values or TSV table separated values.02:19:59Depending on how your vendor handles data, you can select between those three types.02:20:19Oh, now the Cisco Security Cloud app, I'll just do a brief introduction and then jump into the demo just to give you an idea. So.02:20:32Cisco Security Cloud app, this is the part where we gonna see our data being parsed in Splunk, and this is currently our offering that supports the full Cisco security portfolio. So.02:20:48You can see a few names that have a few products that are supported in this integration. I'll cover them in a list when we will be doing the demo. Most important thing here is you get the notified view of all those events in one dashboard, and this facilitates as well how you.02:21:06And the incidents and how SOC becomes more efficient over that. I left you here the URL about Splunk base and the most important thing as well to check when you're on Splunk base, as the left image here is check when it was the latest version released, the compatibility.02:21:24The compatibility to make sure that your instance is compatible with the app so you can see there.02:21:44From where this is supported, so it's supported from 9.1 till the latest ten release. And maybe you also have to check your version in case that you want to update the context as well. And this application as you can see there has.02:21:51Support from Cisco, so this is a Cisco supported add on. What this means means that TAC should be able to support you in having problems with this particular application. This is a supported application that receives.02:22:06Support tickets in case you're facing issues. And this is again just for reference, right? This is for reference and to see the gains that you get when you use the Cloud lab with Splunk and I want you to pay attention to the right most.02:22:22Which is.02:22:43In the end of the day, we are utilizing syslog, we are moving away from proprietary protocols. In in terms of event qualification, we simplify the workflow. We are thinking long term strategy with the scalability and complexity that is being reduced.02:22:45We are also having in terms of configuration complexity, give you a hand in terms of like guiding you or simplifying how the workflow looks even firewall management center. The event type supported, we are trying to make them more comprehensive and rich with the FMC data.02:23:05Again trying to establish that parity one to one with the streamer and for the incident response part.02:23:25Here plays a key role, which is depending if you are using Splunk essentials or Splunk Premier, you can also then boost this data with AI, automation, and even the Splunk server part.02:23:32On top to facilitate you to do decisions, so nowadays for instance, the Cisco, sorry, the Splunk Phantom is now called solar on prem. So you can have then those, you know, playbook automations that you can then use the FTDC log data and do.02:23:48Response actions in your mission control.02:24:08Okay, ok, and sorry for bothering you so much sliding. We gonna go play with it with data. So from zero into syslog, and I'll move my tab in a second to the lab and we're gonna.02:24:14Just walk through a few things that are quite interesting and I'll begin by showing you just a second, by showing you 1st and foremost from the firewall side, then we'll jump into the.02:24:31Into the Splunk part. So bear with me, this might be a bit slow. So before we begin, we will check a few things. So 1st and foremost, what we need to establish.02:24:53Is we need to build the integration and that's what I want to guide your attention to begin with. So as you can see, I know that I'm now in the snort three rules, but as you can see the UI is representing already the same UI experience that you will see on security cloud control.02:25:11And here you have, I'll just go again to the places where other configurations exist. So to let you know that I'm not using the streamer and where a streamer is. So we don't have any client extreme.02:25:30Configuration done, so because we want to move away from it and as well when you are configuring platform settings for the old syslog, if you go to the devices, platform settings.02:25:47I also don't have anything deployed for my threat defense as a settings policy for the legacy syslog. So here will be where you configure the legacy, the legacy one. All today.02:26:02Idea is let's integrate it with Splunk and how does it look like? And of course I already have a, a profile configured that is being sending events to my Splunk instance, but I'm gonna guide you through.02:26:17A new configuration from a new template. And as you can see before we even restart the configuration, you have a very beautiful guide that you can get pointed from you within your FMC. If you click on this hyperlink here, you're gonna be pivoted.02:26:32Into the guide menu that existed in your disk, there's L files and then you can give you like some ideas how to do it and some limitations yes? And you can also see that you have two targets here showing that you can use.02:26:50The firewall threat defense as a source or your firewall management center as a source to send syslog to Splunk. So this is this representation here just to say that you can send from both types. And as well, after you have.02:27:09A profile configured. If you just slightly mouse over here, it will also tell you what did you enable and from where that source is coming from. So in case you just want to see before you click the pencil to edit, you can just mouse over, you can also see which interface of that device.02:27:26This is actually forwarding that traffic, protocol import.02:27:46So let's begin with the simplification yes, so pretty much what you have to do is follow this simple wizard that goes 123 unless you are doing TLS, then it will stop you on four to configure certificates, but moreover, you can drop here.02:27:51An IP address or configure a network object I actually configured a network object in the other one. So I'm gonna utilize the same. This is my network object.02:28:11Here, here's the key, if you are already doing other logging to your SIM on the port 514, you may want to adapt it to a different port from the allowed range or you can leave it by default, it just depends of other things that you.02:28:21Have deployed in case you noticed before, I'm using 8515 in the other one that I already have created because I already have.02:28:40Some stuff configuring my Splunk that utilizes that port and do not have any conflict, I run a custom port. So if that's the case applies to you, you may want as well to check which port aligns best to you.02:28:49Let's say for the sake of the demo that we leave it by default, like I was mentioning before in case TLS does a specified port setting on the 6000 and then you have to configure which certificate authority you want to utilize.02:29:06Next, and here we're gonna go to the event types and here in the event types we can select what we want to log and forward to our team. So in this case, you can just strictly.02:29:24Forwarded logs that are just security pretained for the connections and use the source as the FTD. And I'm gonna show you something that is quite important which is in case you change the source.02:29:42To firewall management center, keep in mind that there's this warning here that when you are enabled this option, it means that if you are managing multiple firewalls, all this information will be sent from the FMC.02:29:56To the Splunk so it will cause an overload on your firewall management center because you're logging all the information from all the firewalls that you're managing and sending from your FMC management interface towards Splunk. So you can already see the overload that this is if you're not directly lo.02:30:14Logging from the FTD itself yes? So the more you are managing, in my case, I'm just managing two, it would be fine, but for what I do in lab, keep in mind is just a lab, but it could just be just a very, very.02:30:34Annoying thing to happen into your network that you are actually doing, managing 5100 devices and then you would have lame ruben about telling you to use the FMC as the sources. So you can select here then the FTD and for instance, you should.02:30:53You want to log everything, you can log everything. If you're just interested in security events, just security events.02:31:12For intrusion, here's also a key important thing because the flags, the impact flags are kept on FMC and when you select FTD, it will just tell you that, keep in mind the FTD information doesn't include impact flags because those are stored on the management center.02:31:20So in case this information is not important to you.02:31:39You can leave it as it is or you can take this information from the, from the FMC. The million may vary, you may have different requirements in your network. I'll leave up to you to decide to decide that one.02:31:45And for instance, then for the rest, if I want to collect additional information that only is collectible on the on prem FMC, for instance user activity correlation and discovery, those are not changeable, they come from the FMC.02:32:01The intrusion packet though we can decide from where we want intrusion packet information. And this is where it's almost closed with what you're doing with the streamer, this is the additional information that I was mentioning that was missing on legacy that came now and also this is also a new time that.02:32:18That just came in ten.zero. And moreover, it tells you about actions that were happening with the malware prevention. So if you hit next, you can select, for instance, if you have multiple devices, which is my case.02:32:37I can tell like, hey, listen, firewall management center, if I want all the devices that you are managing, sending this from management interface, I'll just leave it and I will not change or I can manually select which devices I want to be logging data.02:32:57From and from which interface I want them to send the data. The important part here to note as well is if we are going to utilize and we will in my demo later on, if we are going to utilize.02:33:17Advanced logging, we don't want to change the management interface as the primary interface and the only interface to be utilized because there is a limitation I'll talk about it later, that you want to use the management interface, it will not work.02:33:34Well, if you are taking a, a data interface to work with advanced logging, but as well, for instance in case you have specific security zones and interface groups, you can also use this option to select which ones. It's like a wizard.02:33:51Keep in mind there's here the information that only routed management, switcher loopback, zones and groups are allowed and I decided like this and if I wanted, for instance I can cut the device off or leave it yes? So if you do next because you're not doing certificate.02:34:10We're gonna get the summary of the full configuration. We get the random name usually starts by Splunk_a bunch of numbers in front, but you can tune it, we can even call it Splunk demo, and sounds about right everything we did throughout the wizard. We can just press submit.02:34:29And then it stays yes. And the selection is those two devices. If we wanted now, you can just press deploy and deploy them. I will not do I will not go to I will not I'm not going to do that because I already have one running, but then your next step would be.02:34:51To deploy, to have this part done. But if you didn't log at the policy level, you are not doing anything yet, right? So you just created the target, let's say, and then Splunk will be listening in the other end and we'll check in a second.02:35:11What we need to configure on the splunk side, but right now you just did the, the integration per se. We just need now to understand what we're gonna log because, we also don't want to log too much but we don't want to log too little. We want to have a balance on what we are logging, it's up to you.02:35:27The volume of data that you have, the volume of licensing that you are doing and as well the storage that you have. You have always to think about all those things, and then log the.02:35:47Appropriated rules that you want to log into your syslog target server or your Sim yes. So if we take any of these rules, for instance, if you take like a risk apps, and if I click on the pencil, any rules that will be logging, you're gonna have this little.02:36:04Little paper icon here on the top?02:36:24Saying that the logging is on and you want to make sure that your syslog server is available there to be selected. Even if you skip ahead, like I did, I didn't want to logging and show you where you configured that. If you skipped it.02:36:27There is this information icon here that tells you before you do anything, the syslog default server will be determined by what you have on logging. Although you can override it, you can here specify overrides, but it will take the configuration that you did on the logging. So.02:36:45Right now it's logging. It's pointing to that target. I also have integration with secure network analytics, but we care about the syslog one. So we canceled this, this was just to show you the location.02:37:04And then 2nd part is you click on more and you have logging here. And here I'm logging to a syslog server and the destination is my splunk. So my Splunk is basically a network object again, a host IP address converted in a network object, so it's called Splunk.02:37:21And then I'm applying it to the default login settings so by default, this is gonna be always the target unless I override it by some other configuration that I want to. And if you go back to.02:37:38Access control, you literally can log anything. You can delog your default action by clicking on the cogwheel selecting that you want to log your default action. For instance, there was someone asking before on a chat and I pointed to the commentation, you're doing decryption.02:37:54You can also edit your policy that you're doing decryption and even on the decryption, if it's the case that you are doing that, here I'm mostly I'm mostly doing do not decrypt, I'm doing certain certain other things that I'm actually resigning.02:38:14There is the little icon. If you can find it here, you can click on this guy, and if you want, you can send this through syslog. Then this information will be sent.02:38:33To the syslog. I don't have the need for now for my demo to do it, but you you can certainly do that or you can do that for the default action, of course, and then you can do by rule.02:38:49If it's the case that you are actually decrypting and collecting that data, click on logging again and then apply the syslog for those, for those that I'm actually sending them it was mostly for demo purposes, so you can see where the option is. You can certainly do this.02:39:04There's a quite important thing that Christophe mentioned and earlier Constantinez mentioned as well about snort mL, quick and those threat detections that Eve is doing. There's also something important that you can always do which is client threats.02:39:24And you, if you have rules that are moreover doing inspection for URLs and quality of the URL content that you're checking and such, you can also go to client thread, make sure that you have EV engine enabled and you can select.02:39:43A few threat categories or like high risk processes, add them to your client process risk on the right, and then get an evaluation about it through EV engine if there is something.02:40:02Suspicious passing to encrypted traffic and get the classification from Ivy about the score of that particular process if it might be malicious or not.02:40:19And of course you have the settings I'm not gonna touch here. It's not regarding logging, but keep in mind some of those things can also be enabled and you can still be collecting syslog with those things enabled yes like decryption for quick, and then you are logging that thing to, to the CM part.02:40:35Okay, oh cool, we're not gonna need anything here. So now we have two pieces yes? So we have two pieces, we have our access control policy in place.02:40:54It's deployed. We have the Splunk integration deployed. Let's assume that I deployed it yes, and pointing to my Splunk cluster. So my Splunk in this case is just a standalone box. It's not like a full fledged cluster deployment with separated foreheads, every other.02:41:10And every forwarders and everything or universal forwarders.02:41:30And and all that complexity that a cluster can have is just a simple box doing everything standalone server. What we did there and we're gonna jump into Splunk was just we installed the application.02:41:35The Cisco Security Cloud app and you can do it from multiple ways. Yes? You can do it actually from three different ways. I'm gonna show you two and then you decide what is the best for you. So you can go to two apps.02:41:51And you can go here and browse for more apps, and for instance search here for that particular one. So Cisco secure.02:42:11It's a Cisco security cloud that is already installed yes so it shows open up because it's already installed. So you can search it from here every time you want to install something through the store, you have to authenticate yourself with going to show, for instance, if you click on this one, it will show me a pop up to log in to install to see if I'm.02:42:33I'm actually allowed to install it or not and then install it. So you can install the app from here or there's also an application that we have now that I also recommend you to use if you have the time, which is if you go to apps, you also have this.02:42:52Calls Splunk Cisco app navigator that you can also install from the place that I'm, that I was before, that it will scan all the apps available for Cisco portfolio.02:43:12And tell you from all the available apps, how many configured products you may have or configurable and which application you can utilize. So for instance, from Cisco you can see that all these things I can get access to.02:43:27If I want to configure those products or available products for configuration, all of them, they come from the Cisco security cloud app and they are not configured yet. But the ones that I also have already some configuration, I can just give it from here and launch it and it will launch through the.02:43:46Cisco security cloud into that particular product configuration, yes? So this is a one that gives you like the Cisco products ecosystem intelligence and everything around Cisco applications that can be installed and the value.02:44:03To which personas it might give value and to which components of Splunk it also can integrate with. That's a way to do it. Other way we'll be you go to the URL that I put you on the slides, you download the app and you install app from file.02:44:19You have to upload it to your browser for instance, and install it via via that file that you just downloaded. So 2nd type and that's the, the, the ones that I wanted to cover because you can also install it from the CLI. The CLI you just SSH to the device.02:44:36Can probably connect to the device, you SSH to it, you do the Splunk CLI Splunk install, you put your credentials, you put the app name, assuming that you already loaded into the disk, and you can just.02:44:56Installed it. The final result that you're gonna get is this Cisco security cloud app, and I'm sorry if I'm, if I'm going too fast, I hope not, is now here you can configure all the applications from the portfolio available and custom.02:45:08Them in a way that will work in your environment. Like we saw before, we configure.02:45:28With a particular port, the one that I have there with the 8515, it's 2nd entry on the table. We can click here on the index to edit the configuration, and as you can see here.02:45:35I just put the IP address, so I configured the input name with syslog as UDP type, custom port 8515, IP address of my firewall management center. By default it will give you a cisco FTD syslog as your source type.02:45:50Because we are not logging like as ASA syslog, we are logging Cisco FTD syslog. And here I selected all the events including advanced logging, and it creates an index called cisco_SFW_FTD_syslog.02:46:09And from that moment, it starts to check if there's a connection against my FMC and starts to receive events. In case of any difficulties, you can pivot it in these two links and it then it tells you more information about.02:46:25This sort of configuration. You can always validate under resource utilization in case you want to troubleshoot, there are gonna be here like two dashlets down below that tells you about, so input connection here.02:46:42It May take a bit to populate because this is doing in real time and have a lot of data going in. Try to just hear the zoom, and it will tell you here on this table when it loads that this is the sources that are logging activity and the.02:47:02If there's any downtime happened before, if you are everything's fine, if there's possible a reason it will tell you, so you can get an idea of IT ops can get an idea if there's anything wrong or the admins of Splunk, you can check here if something went wrong with the data.02:47:22Where are you gonna find now information about firewall? Quickly and easy, Cisco secure firewall dashboards is your place to go. You click here, and it will present you a list like this.02:47:43And then from here you can browse the data at your own wheel. You can ignore the connection events on top on this one in particular, my demo instance is behaving a bit weird today, but you can literally if you have the proper access.02:48:00To the, as admin or power user, you can then take whatever data you have here from the magnifier into an SPL search or if you have that level of access that is not read only, you get these additional columns here that you can search in real time.02:48:20A particular IP address, for instance, if we put there 10.1.13.95 because it's an event as you can see here, probably not the most brilliant one.02:48:40But you can filter by that particular source IP address and then you get just the statistics around that particular event and gives you like all the intrusion events in particular this one was affected by an intrusion event, and you can.02:48:56Get an idea around it. That's one way to consume the data. We'll see a bit more later. I'll try now to move against to the deck from that integration side with this.02:49:13Pretty much everything. The next thing that I wanted to touch base is the advanced logging capability and fairly quick, what we want to address with advanced logging capability is.02:49:33We want to fully emit full protocol level telemetry from snort engine and give the SOC teams a Zk like visibility without the need of deploying separated sensors. So we are trying to expose broad network conversations such as.02:49:51DNS lookups, HTTP exchanges, anomalies and more, so the firewall becomes a native integration source for advanced threat hunting basically. And I leave you some resource down there if you want to read more about it, and it's also mentioned on the resources later.02:50:10But that's the innovation I want to give you with advanced logging. It's simple. We were speaking about ACPs before, right? And you probably If you had the keen eye, you saw the advanced logging logo there as on. So it simply you enable.02:50:26That option, if you select which ones you want to, which events you want to enable, you click confirm then after your selection, and then after you click then apply and move away from the editing mode, a new icon will appear next to login with the plus sign, which means like, hey, you are logging additional.02:50:42Data. Keep in mind that this data gives you more fields to explore and investigate, but they are not available on FMC or cloud FMC UI. This is just just data for SIM consumption.02:51:03And there's a ton of them, for the sake of time, if you already work with Zick before Zek alike, and you know a bit about Zick, you know that everything.02:51:22Goes around connection UI ID, so the connection ID will then interlace all the information from DNS HTTP, FTP and weird behaviors. Everything starts from a connection ID and then each single one will have different.02:51:36Evaluation fields, but the key point is to maintain the consistency between the initial connection ID and then cross check what, what records were done by DNS or why I have this HTTP request then cross related with the, what was done at DNS level and from which source ID.02:51:56That connection ID originated, so on and so forth. That's how we are trying to tie up all these additional fields. We are using the snort inspectors, there's some documentation here for doing all this work. I left one of my favorite ones on screen, which is the weird one because the weird one is used to record.02:52:16Part of unusual or anomalous network behavior that does not conform to expected protocol norms.02:52:35So what this means basically, so they are evaluated by the snort inspector rules and basically because those inspectors have already a dozen of protocol specific inspectors, they will.02:52:43Verify multiple rules designed to detect protocol deviations and expected state normal form activity and tell you that maybe something is weird for that protocol. Why I'm having such a volume of traffic coming from this particular type of protocol even.02:52:59This part that I'm not even.02:53:19You know, by default running that protocol type within that port. Imagine like you have like a massive four gigs transfer over telnet on port, I don't know, 6000 something something or over other.02:53:21Crazy protocol within a port that is not the normal behavior of that protocol. This weird will set that deviation and will inform you about those deviations and should be places where you actively should thread hunt for anomalous behavior. It's kind of similar of.02:53:42If you think about it in some extent, I don't want to, you know, open a fight here between products, but to some extent on how we are doing it with secure network analytics on traffic conversations, expecting inspecting anomalies, the words.02:54:01Fields done by snort inspectors behaving in similar fashion. Now, I just want to mention a few limitations about advanced logging. I touched base.02:54:19A bit during the demo about that particular thing about the interface management interface, but nevertheless, it requires supposedly requires the ten.O because that's a feature from ten.O or CDF FMC and we started.02:54:34Long back since December last year.02:54:54So all the managed FTD devices have to be running ten or later, of course. Any configurations that are applying tools code versions are completely ignored. Firewall that is being self managed by FDM are not explicitly not supportive, even if you're running ten.O.02:54:57It's not capable of doing this particular configuration. In terms of telemetry, it's restricted to syslog export only. We are sending events to the sending events to FMC or cloud FMC is not supported.02:55:17So it's the directly being sent from the firewalls. You have to configure a destination, for instance, we configure today's Plunk, and for parsing this data, you can only parse it for same consumption under the.02:55:34Sub option within security cloud app that is called advanced logging, and then there's a dashboard there that will pass this data. Like again, there's a bit of caveats when it goes to performance, but this is a completely expected because.02:55:50As well, the more you log, the more you are creating loads within your system. So it's expected, and I'll give you some links on the resources, it's expected to eat a bit the CPU consumption on the firewall around ten to 20 %, so.02:56:07We usually suggest you on the logging best practices. There's a logging best practices document that I'll share in the end that, you know, don't enable everything from the start, go slow enable as much as you want to enable, but take it easy.02:56:24Until you get to a point that you enable everything that you really need. And in case you are going for a large scale deployment or performance sensitive, you should consult back, open proactive case.02:56:42Check with them how you can do this. Again enable stuff when you're enabling advanced logging per policy go slow again. Enable a couple, then check how the performance is going and then make your own judgment and.02:56:58Keep enabling as you go. I will quickly again cover the same option because it's even a bit in the configuration, so I just want to make sure that you guys know where to find it.02:57:14We're gonna jump back to my, to my FTD, and we're gonna jump back to the place that I want to be, which is on the access control. So go to policies, access control, pick the policy.02:57:30That you're planning to have this, this logging, I'll take 2nd one and it's interesting where it was decided to reside because it's you have to go to more.02:57:46Before you actually be able to enable this advanced settings scroll all the way down until you capture this new feature called advanced logging and make sure you set it in the Boolean to to enable this.02:58:01So you click the box to enable, you set your destination which will be your Splunk profile. In this case, when I'm sitting here Splunk profile, it's gonna take it from the Splunk integration where we're doing. It could be other target and then you have to.02:58:18You know, select according which format to to ship, we are shipping Jason to Splunk and in this case I'm applying to all the Splunk profiles if I will say do syslog have to select the dedicated syslog server yes? In this case, imagine if I have like 1015 profiles.02:58:38Which is the maximum, all of them will receive this data and then probably there will be tons of duplicated data. If I want to be target unconcious about that, I can just pick one unique location and send it to the unique location. Since I only have one there and the test was not deployed, I'll save it.02:58:58It will enable the, the option and from now on on access control, this option is available for consumption, so I can literally click any rule now, and then the option will be available for configuration and here I can just.02:59:18Select which things I'm trying to log and which information I want to collect. For instance here I enable everything, but it also gives you an idea of like which information you are logging for each type. If you press the I button information button, you can get an idea. You.02:59:36Select what you want, you confirm, and you press apply if you did any change.02:59:56And then the moment that you want to put it live, you just save the changes and deploy to the target devices and then that information will then be available for consumption from the integration that we just did. We don't need to touch anything else.03:00:02It's getting to the, to the splunk side and in terms of how it looks like I'm having actually some issues with my lab today, but there's gonna be a sub menu call advanced logging dashboards and all that data.03:00:19Will then populate these tables here. At the moment, my tables for that one are empty because of the sole reason that if you have the keen eye again and you noticed under the secure firewall dashboards.03:00:35There is something happened with the connection events that are not coming and connection events are actually required in the other end to be populating and being evaluated for the behavioral analysis. Yes? So that's why, so just to keep you in mind, that feature works is just I'm having here a bit of a hiccup with the.03:00:52With the connection events today. Alright, I'm conscious about the time, but I still have a bit more for you in plate.03:01:11I have just asked for a minute to David to unmute and tell me how much time I still have left because I want to as well give you a bonus. It's 12:10 or 01:10 CET time, so 10 min yes.03:01:28Yeah 10 min and then close it out as well, so.03:01:48Yep. Okay, great. Thank you. So this one goes, this is a bonus and this one goes towards my colleagues and when I'm sick colleagues I see audience as well that work on SOC.03:01:52That is a conjunction of secure firewall together with Splunk enterprise security. And it's just to give you an idea about how we can unify both for, for threat hunting use cases. I have a few here on the slide.03:02:09We're not gonna go into an active active threat hunting as well because conscious of the time, but I'm gonna leverage you some ideas to build a cool tool set around it and then benefit from the firewall detections for enrichment of those things.03:02:26So, there's a ton of advanced techniques nowadays that apts are running C two traffic. More, more likely if an APT bridge your network, you're gonna get.03:02:45Infected and most likely gonna be beaconing back to their control and command server. So quite important to find spots where we are looking for beaconing detection, looking as well for lateral movement east west analysis that can be done in conjunction on the enterprise security.03:03:00Security looking for anomalies in case of that exfiltration coming from certain outgoing for outbound destinations.03:03:20Checking for byte size and destination IP addresses, then taking some looks around doing some IOC sweeps or indicators of compromise to check from historical firewall data and nearly discovery.03:03:31Indicators to see if there's anything else that maybe adapted or added to either as a snort tool or either as a custom detection on splunk's side and then together as well leverage in the end of the day the encrypted visibility of if within Splunk searches because there's also custom detec.03:03:48Actions.03:04:08From Eve, and I'll show in a second that can augment your capacity within mission control and then create particular custom detections on splunk side. One cool place where you can find this information you have a GitHub, you.03:04:10Have it as well on Splunk based you can only from Splunk base, upload and install or as well search even the store or something that is called Splunk ES content updates.03:04:29So basically, this is a project that has a bunch of analytics stories guides that provide background on PTPs. And all of that is mapped to my attack framework. We have the locked marketing cyber kill channel as well showing there the stages and the CIS controls as well.03:04:41They include a bunch of splunk searches, machine learning algorithms and things that you can then apply to the SOAR part as playbooks or old phantom as we used to call it. And those things, this type of content can allow you to.03:05:02Design and work better on detect, investigate and respond to threats because we have quite a customizable amount of them there that you can start or clone or edit. You don't need to be all alone deploying your own custom detections.03:05:19How it kind of looks like in terms of the detection looks something like this. So when you have the two things combined, so you have Splunk security content installed and enabled on your mission control.03:05:34And then you have advanced logging as well popping from firewall. You can get findings, you can get other things that are like higher critical depending on the type of custom detection that is firing at the moment and give you an idea of like what is the original Splunk source if you can see.03:05:51Different images are custom.03:06:11Unit detection from, from Splunk that was designed that is called block connection rule. And you can see the annotations in terms of TTPs, the technique which is reconnistance, what was the identity and what were any kind of intermediating findings. So this thing.03:06:13Was installed from that content enabled and then basically based on that rule being enabled and over time of consumption consuming my logs, it started to pop up some some information yes? I'll just quickly show.03:06:33See how it looks like before we do the closure. It's pretty simple. Again, this is the it's only if you are running that particular app. So the moment that you install the content updates, you're gonna get here a wizard that tells you.03:06:52What we have, in terms of detections built, you can see how many detections we, we built, the analytics stories that you can use and the amount of response playbooks that you can utilize, and some of them will use the firewall. So the.03:07:12You can go to onboarding preview and from here, you're gonna be asked what source you want to utilize, and here will be the point that you can search for firewall Cisco firewall. So you type here Cisco.03:07:28And you can see there is more stuff for other solutions as well, so network visibility module, EOSAXE, and the firewall here on the bottom yes? So if you click here on the firewall, you press next on top. This is just a wizard to allow you to quickly go through it, yes? Because if you don't.03:07:47Use this wizard you need to go on the customer and enable everything by hand. So here you can click this box to enable all these particular rules and it will tell you which TAs you need and which data you need.03:08:07Here at the moment I'm having some issue with that data as well. And you press next, you define the time range and the acceleration for the cron and you just click enable and all of them suddenly will become enabled detections on your mission control.03:08:22And then when you go to mission control, all of them will be under your security content under your content management and in case you are interested in.03:08:40Reading what they can do, you just type Cisco secure firewall, and all of this you can see here I was mentioning about EV for instance yes you can see that all of them are enabled and for instance, if I want.03:08:57To do something with you, I can so come here and see what is actually doing. So for instance, this one, if I get the score equal or greater than 80, it suggests that the connection is highly likely to be associated with malware or command and control callback.03:09:17So I can get those. The source type comes from my syslog, we didn't need any stream or anything. We just did syslog, and this is our index that is being consumed. And then we can see the statistics on how much this invocation was done for this particular rule. Then you can get it.03:09:35On the analystic view on analytic analystics, oh, sorry, under your analyst queue, those detections popping up over time. Yes? This was the bonus that I wanted to give you about this content integration.03:09:54Alright, so takeaways, pretty quick takeaways. We want you to think about starting fresh with the and move away from the streamer. In case you have the streamer, you can.03:10:15Move away slowly and then fully completely kill away the stream client. But in the end of day to start leveraging the new syslog on ten.o, we also have now a special offering with the.03:10:32With the firewall component, which is we have this firewall logs at additional cost with Splunk. Keep in mind actually to see the asterisk on the bottom, which means that you are allowed up to five gigs device a day.03:10:52If you have a firewall threat defense and sorry for the threat defense there, but the firewall threat defense subscription and Splunk license, you are allowed per device a day, five gigs of ingestion of data into Splunk.03:11:08As well, I want to give you some resources which is our YouTube channel that you have latest demos and tutorials, including what I probably covered today already there, alongside with my colleagues what they covered today.03:11:26You have that capture, you have that URL, very easy to find Cisco secure Firewall under YouTube. We also have the place that I mentioned about the guides yes, the secure firewall essentials. I would say go to secure.cisco.com and get the instructions on one page step by step guidance better.03:11:42Best practices, everything I covered today in terms of logging best practices will be also described there and we are already covering their.03:12:02Multi cloud defense for the hybrid mesh stack and everything on the same page and including micro segmentation for that case. And last but not the least with the same importance, I want to talk a bit about the customer success education and your role and what you can play.03:12:11As well defining this, the sessions. So 1st and foremost, I want to talk about our cyber capsules if you don't visit cyber capsules before, but the cyber capsules is a series of videos that are packed with expert recommendations. They typically last between ten to 20 min.03:12:30Since the name of being.03:12:50Short little cyber capsules, they are aimed to significantly enhance your posture, your security posture at a particular product and at least covering one key feature that you may not enable yet. So to give you a demonstration of practical use case of that feature.03:12:53We currently have around 30 or more.03:13:12More videos or so. We are planning to add more over time. You can please use that QR code to access them. I can then maybe share a link on on the chat or on one of the panelists. As well to tell you that the upcoming session that you have, the registration details were on that link.03:13:14On top I actually put on the bottom in case you want to take a screenshot.03:13:34The next webinar that we are covering is already, I believe next week. If my mind service meal 16 is already next week with that we're gonna be covering Duo and all the things around enabling.03:13:40Duo for your identity and management and everything around the strengthening your environment, strengthening your environment with Duo and around the portfolio. If you found that.03:13:55Today was helpful and you want to learn more, I would recommend you to join those upcoming sessions. And then again, if you don't get any link or you not subscribed to any mailer, use the link below to subscribe.03:14:10And the last, last, before I let you go, this is actually a call to action. Your input really matters to directly shape how these sessions look like. It always improve, help us improve and tailor the future sessions that we deliver according to your needs.03:14:26So you actually are the main voice why we are here today covering this set of topics and tomorrow as well?03:14:46You are responsible for shipping the agenda, so please when you're receiving any form in the end, help us to know what topics are really matter the most to you and we get them covered in the next sessions.03:14:53And as well, there will be an automatically survey survey open after we finish this webinar. So I really, really would appreciate and my colleagues here today that you would provide your inputs.03:15:08And make this shape again these webinars and with everything said, sorry for like the the long session, but we are done for today for the 1st day of our.03:15:24Cisco secure Firewall delivers on optimization and new features of ten.O and including as we did in the beginning of the day. Thank you so much for your time.03:15:40
About this Video
Author : Cisco Customer Success
Uploaded : June 11, 2026
AI summary
Explore the latest innovations in Cisco Secure Firewall version ten within the Hybrid Mesh Firewall strategy. The recording shows how to deploy unified, intent-based controls, inspect encrypted traffic efficiently, and streamline cloud and SIEM integrations. Follow step-by-step enablement of Cisco Encrypted Visibility Engine and the new decryption policy workflow (including QUIC), activation of Cisco Snort ML to detect SQL and command injection, and configuration of enhanced telemetry with Splunk via the simplified syslog wizard. See how Cisco Security Cloud Control introduces AI-assisted policy, AIOps, and the Cisco Mesh Policy Engine, and how Cisco Multi Cloud Defense simplifies public-cloud deployment and high availability.
- Enable encrypted traffic inspection: configure Cisco Encrypted Visibility Engine, inbound/outbound decryption, and intelligent bypass.
- Accelerate investigations: activate Cisco Snort ML, turn on Advanced Logging, and integrate Splunk in minutes.
- Operationalize at scale: use Cisco Security Cloud Control and Cisco Mesh Policy Engine; plan upgrades; deploy with Cisco Multi Cloud Defense.
Internal error
No related resources available.