Learn how to leverage AIOps

Okay, once again, thank you for joining our, for, for joining us with our look for our learn how to leverage AI ops session. My name is Harry Davis. I'm the director of customer adoption for secure files.00:10Firewall product. Joining you today leading this presentation is Alexander Tores, customer success Specialist for the secure firewall pipeline. Before we start a couple of housekeeping notes, please feel free to ask any questions in our Q and A section and our panel of customer success engineers will answer as many of those as possible.00:20We anticipate material taking about an hour, 45 min to an hour, but we will try to answer some questions live if possible. And again, if an end short, we will send out a recording. Once again, once the event ends, we will capture any and answer any outstanding questions in a follow up email to all attendees. Finally, there'll be a short survey asking about the webinar and an option to request further doubt.00:35With that completed, I will hand this over to Alexander to kick off the session. Alexander over to you. Thank you, Harry, and thank you everyone for joining this session. Again, as Harry said, my name is Alexander. I'm a customer success specialist.00:56For providing support for secure firewalls on our customers. So I'm happy to present this AI ops session for you. What is AI ops? Let's start with that. So.01:13Aiops is basically a cloud service. Cisco provides this service to and it's available for all of our customers who have already a license for their fmcs, basically our firewall.01:31Users and it's used the capabilities of aios allows you to automate and improve how firewalls are managed. So basically, given our the way things work as of today, things are harder are to manage like.01:48Properly firewall rules and as comp companies scale and new security threat threats appear then keeping up to date like with the firewall rules is it requires of course constant updates so you avoid new risks, right? Network changes on a faster pace now.02:08New vulnerabilities are discovered every day, so it's this it's difficult to handle and to have a proper firewall management if we don't have like and we could even create security holes that could be exploited by attackers if we don't like take actions promptly. So AI.02:28Ops is one of these cloud based features. He leverage the use of AI again to correlate on.02:48Your unusual patterns in firewall policies and pass through traffic and device health metrics and those features are used to identify problems early helping those the customers and IT teams, of course, to take actions more promptly and avoid these breaches or bottlenecks.02:56So among the tools that are included in aios, we have currently, again, it's a cloud service, the key capabilities include like policy policy optimization, which means like also like provides late recommendations, root cause analysis.03:24They will be reviewing some of these and hopefully we will be showing like a few videos on how to browse it and how to see it. Again, AI OPs is currently part of the cloud security features so you should be able to access it by going to security.cisco.com.03:44If you have a tenant without a CDFMC, this is already included on it on that tenant, but if you have your on prem fmcs, it's a matter of registering that FMC with the security cloud control so you can have access to some of these features at the end of this session, we will.04:03Show which of them are available for on prem and which aren't.04:23So kind of like a quick review of our agenda, we will of course review like summary insights, policy analyzer, optimizer, feature adoption, best practices feature tool set and a software upgrade tool set.04:34I use the risks, AIO roadmap highlights and then a few additional highlights.04:52So, health summary insights is actually focused probably is probably mainly is focused on the performance issues monitoring of performance issues, CPU and memory, which I often can go on detected until there is a real impact. That is the problem being addressed here.05:09With the summary insights, users could have like a monitoring real time monitoring to remediate any type of CPU or memory.05:29Causing causing problems in this detection engine and with real time alerts for CPU and memory consumption of course this is how it looks basically. This is the dashboard that you will find with the health summary inside with the health summary insights.05:42We will have the option to monitor the healthy status of each of the firewalls registered on your FMC and it will give you early warnings on health anomalies and each inside will also include a possible like root cause.06:01With a confidence writing basically as we can see here in this quick screenshot here.06:17So metrics like CPU with the current like level of connections or number of connections or like input packet count, just to.06:32Try to correlate to the issue, the ongoing issue with possible root causes. This is something that you will be again able to review real time on your on your tenant, the security tenant.06:51Traffic summary insights is another feature, another of the tools included in the summary insights, it includes like organization lack well the the issue address here is the lack of visibility into network traffic patterns and VPN capacity which of course leads to performance bottlenecks and.07:16Service degradation. So, it focuss on three main areas here. One of them will be like the identification, identification of elephant flow detection, monitoring of VPN capacity.07:36And the detection of connection rate anomalies. With this of course we will have like optimized VPN performance through the detection and capacity constraints. This is how the dashboard looks for elephant flows.07:53As you can see here, there are a few applications which are suspicious to be causing like to be running through elephant flow connections. This insight includes an application centric view.08:11Into how the flows generated by them are consuming the network resources in case of any sudden spike in the connection counts for a given firewall.08:28The AI ops engine correlates data points to give you more context and breakdown.08:47Of connection patterns to quickly mitigate the issue. This is the connection rate anomaly detection and this is basically monitoring how your.08:53Again grows on time. So as you can see the.09:13The number of it it moderns, it moderns the pattern to give you an early prediction on how VPN session is incre is scaling scaling over time and of course this will give you awareness if the firewall is will be capable of meet.09:17The demands of your specific environments this also this inside also includes the steps to avoid any catastrophic scenario related with the engineering increment of an organization's remote user account.09:35So this is how a quick look up of, of how the dashboard looks as you can see here, the the UI is within the security cloud control in this case, this is.10:16A test tenant, of course, but it's included in security cloud control which means the registered devices or the ftds from where we are collecting all of these statistics are currently registered on a CDFMC. This is how you will, this is what you will see if you access the file.10:36Section within the security cloud control once you have your device registered to a CDFMC.10:56And then from here you can of course access the inside reports view that we're seeing in this quick video. So it's basically showcasing like here where you can find specific features we already discussed before.11:03This case we are seeing the possible well we are monitoring the snort memory on the firewall and then the connection rates and how that could be related with the current spike in the CPU.11:21Let's move to the next tool, which is policy analyzer optimizer. This is one of the, of my favorite features of course policy analyzer optimizer helps enterprise users and customers of course to well to to address the specific issue.12:00Of managing very large access control policies which as time passes while they will of course increase and new rules will be added sometimes depending on the size of the of the of the of the company and the number of users managing the same firewall it's.12:20Possible that new rules are included which.12:40Duplicate already existing rules or shadows some rules that are, that were configured before or sometimes it's possible that users can configure like temporary rules in their STDs and.12:44Even after they expire, they are still kept in the access control policy which of course makes the managing of the firewall more complicated. So basically what is new with the policy analyzer is that it's an AI automated feature which allows the.13:01The users to automatically identify which of these rules are being or written by the other what are other rules and take action, take action very easily to basically clean up the access policy. Of course, it seems.13:21In that.13:41This can have a sign a very large access point policy can actually have impact on the performance of the unit, not only because of the of the size of the policy, which is of course by itself one of the reasons why the memory on the, on a firewall could increase.13:42But also like the the time it processes the file takes to process each of the specific rules.14:02Will increase and on time it can of course escalate. So before that happens it's good to have a feature like this and of course there is a summary dashboard like this one.14:11From where we can see like the number of rules that were analyzed in this specific firewall, some of them are healthy of course and some of them are unhealthy. This is the dashboard showing how many rules are shadowed and expired rules in this case.14:28And so on. We'll see what each of these means in a minute, so duplicate rules are basically those rules that will never be used because they are in this case like shadow rules are blocked by our blocked.14:44By higher priority rules and can could be safely removed.15:04So removing these rules simplifies management without affecting security coverage because basically we are eliminating rules that are basically will never be used.15:11They are by previous rules. Expired rules as it was mentioned before, if whenever you configure a temporal policy or a time based policy and the time expires like this, and this one they are NO longer.15:25Useful or they are not longer relevant on the access policy. So with them AI ops, you can easily identify this and just take immediate action. There are rules that are can be merged together.15:42As well, so in this example we have this rule 77 and then 79. Both of them share almost every, every parameter here except two of them, right? Well, actually just the destination networking here is different as we can see here.15:59The rule number 79 here is adding just like another couple of IP address to the group that we already have on the rule number 77, so this could be easily merged together.16:20In a single rule. With the policy analyzer, we can easily identify these rules and automatically merge them.16:33Overlapping rules is a little bit of the same what we have with an overlapping rule is that.16:54This object, as you can see is a/twenty four network which is already included in this/sixteen, which means that if there, there is a rule above the rule being overlapped, this one will never be hit and then it will.17:01It is basically saved to delete such rules.17:21That policy analyzer is a feature that was added after the initial deployment of policy analyzer and optimizer is basically the same principles that we already saw for the access policy can also be are now being used to analyze network address translation.17:34Against all of these analysis are made on the FMC level, which means what will be evaluated is the configuration on the NAT policies in the FMC.17:54The available actions depend on the NAT rule type. For instance, for manual rules, you can delete or disable selected manual rules, but for autonot rules, you can only delete autonot rules, but you cannot disable them.18:09So let's take a look, let's take some time to review this quick demonstration again. We are again on the policy analyzer section and then here we're seeing all of the policies configured in the FMC and some of them are showing some alerts. In this case, this one is showing like a.18:29Total of 5000 rules.18:49And it's showing that it it can be optimized. So, in order for us to optimize the rule, we have to of course select it and click and view analysis details and optimize here.18:52So, we have the option to select the rules that we want to, in this case to we have duplicate rules, we have the option to select the rules for which one.19:19We want to take action or we also have the option just to choose, oh.19:39My bad, just let me scroll back here a minute just to choose the rule if we if we are just confident that what we're seeing is is well we are confident that what we're seeing is something that we definitely wanna deploy. We have just the option to.19:46To disable all fully channel rules here, just by clicking this.20:06A button or just delete them. Of course, the recommendation is to create a backup of your access policies before you take any kind of actions from the AI ops. So the recommended steps would be 1st taking a backup of your access policy or your NAT policy.20:11And it is also well as a initial stage, it can be good or depending on on your on your confidence, you could just initially start by disabling every fully shadowed rules, in case you want to like enable them like manually later.20:29Or of course you have the option to delete all fully shadowed rules. This will push the change to the FMC, but it won't be, of course, it won't take any action on the managed devices until there's a policy deployment.20:47So this in here is giving us information when the rule was expired and again this mergable rules that can be merged together, it gives us the reason why they are considered to be.21:31Candidates to be merged. As you can see in here says that this rule can be merged by combining the destination network into a one rule. So this is same the same case, but the reason could be any other kind of reason, source network.21:51Applications and so on.22:06Alright, best practices and recommendations. Of course, it's, big managing well managing the firewalls, big configurations makes it hard to maintain optical firewall configuration and of course.22:34Eventually this could lead to the security best practices without considering the impact that this could have. And what is new with this with this tool on aiops is that best practices and recommendations model will automatically access the firewall configuration against.22:49Cisco secure firewall best practices.23:09And does given all generating comprehensive reports with pass fail results. This pro the service provides the specific actionable recommendations for you to consider. So again the firewalls are evaluated again.23:12Cisco best practice depending on the specific features as you will see.23:33Detailed insights are available for each of the features and of course sometimes you will find links for for the features themselves in case you their more information is required. So in this example here we have a couple of checks that were identified.23:40Block uninspectable archives should be enabled. This is basically a recommendation that is given for us feature that is recommended to be enabled on every file policy in advance. It looks like in this example it was found that it was disabled and the recommendation is of course to change that too.23:58And Enable the state this section is again accessible from the side reports and then the best practices recommendation.24:17Link. I just want to show you from here another couple of possible issues that can be well best practices that could be recommended. Well, and what we are seeing here is basically an assessment trend.24:36As new features are available or new best practices are recommended, it's expected that the number of checks will increase, but this is kind of like a graph to give you an idea of how it it will look.24:52Let me just fast forward this a little bit. So by looking at one of the ftds here, what we have in here another some of the other recommendations, network discovery policies.25:23Given of course best practices, sharing links here. And as we can see it's not only like asset or there are NO I mean their best practices are shown not only when there are the features are missing, but of course whenever there are like best practices already being.25:44Opted in the in the managed device we will have this past status.26:03Yeah adoption is another in a similar tool. It's focused on the adoption insights basically and security teams where in whenever they are struggling with optimizing their security posture because of.26:10Lack of of understanding or lack of awareness of the, of the features that are available to be deployed on the FTD. Of course, the, we have now the option to receive.26:31Life recommendations or updated recommendations about the best practices, the, the value of including some of these new features or from the firewall. In this case these are these distributing categories that you could.26:44Either disable if in case they are they are not relevant for your specific environment. This case we have the option to disable like SD one capability here, but in case we have it enabled, there will be a score.27:04Even to based on how adopted or how adopted your complete environment is for this specific feature. In this case, it's the one capability as you can see here shows this dashboard where every managed device on your FMC.27:19Will have an either adopted or not adopted the status and that will basically be the criteria to determine how your adopt your overall adoption score for this particular feature.27:38Of course, there will be links for specific features so you can have more information. This is of course linking us to the Cisco secure portal with more details about SD WAN capabilities.28:03And each of the criterias that are considered to to determine that a specific feature is is fully adopted this case as the one capabilities on the ftds.28:19I just want to highlight again here some of the other features that as of today, they are encouraged are being are encouraged to be adapted like encrypted visibility engine, of course, and in Cisco secure dynamic attributes connector.28:38Among others, of course.28:59These are again all of the managed STDs.29:29Right, let's fast forward one more time just take a closer look to the engine here.29:39Oh alright yes, this is in this case for encrypted visibility engine it will be considered fully adopted if the if we enable the block traffic, as you may, some of you maybe aware.30:07Keep the visibility engine will also have the option to have the, have it like basically monitoring mode. However, that is not considered fully adopted.30:26For the by the by the by the feature adoption inside tool. So just something to keep in mind Software upgrade planners.30:36So I mean, as you've been around, you will see you will probably know that security software updates are more frequent as it, as I mentioned before, as new vulnerabilities are discovered as.30:57Cisco has.31:14Has improved the strategy or modify the strategy that we use for our customers to do like run periodic updates. So every, every 15 days there are new security advisories published like informing about which.31:17Devices will receive patches.31:37So it's it's definitely important and and is is responsible at this time that we're living in to make sure that our devices are up to date. Basically, the software planner is also another alerting and warning tool that help us in having.31:40More visibility into which available software, which software is available for us to perform an upgrade on the managed firewalls and this will of course display fixed CVS CVEs and security improvements for each version.32:00So the planner allows us to compare the current version that we have on our managed device with the ones that are available and the number of fixes that are included.32:27This gold stark here means that by the time this screenshot was taken, this was the recommended version. But as you can see there, there will be like CV fixes notifications also like for even for like not like the best recommended version.32:43But, just something to keep in mind here. We can classify the severity of the CVEs. Well, we can classify the CVs based on their severity.33:03Also like to take the decisions about the software we want to operate to, right, I'll skip this for now.33:20User risk insights is another pretty cool feature basically it allows us to have visibility on any kind of like the compromised user account with for which the firewall has detected malicious insider activity.33:37And, instead of like spending significant time correlating user behavior patterns and determining appropriate response action, we can have these malware basically detection capability in the, in the AI ops of course to monitor like irregular.33:55Irregularities in the user behavior, of course with actionable blocking So the dashboard highlights the list of users that are team like risk.34:17Alongside the reason for for it.34:37So in this case the block users, sorry that this user has been detected as an one impacted user here with a warning level, the activity was classified as questionable because there was a new account used to bypass.34:41Token from denied country.35:01So, the remediation recommended would be to implement targeted remediation strategies to elevate the protection in this for this user, and then the of course the steps that we will have to follow for that.35:04This case is recommended to go recommended to suggested to go to access control policies, review this specific rule within the access policy. Okay, this was created by the dynamic firewall wizard.35:20And then deploy the corresponding access policy to the firewall threat defense device.35:38Oh Shall just take a few seconds here to, to go over the steps one more time?36:12From this section we are again identifying the questionable activity from this user, specifically a new account used bypass a token from denied country and then the redemediation steps.36:29If there is a link of course to take us to the access policy to take action right away alright so we came to this point basically these are this is a quick rundown of the.36:46Of the features that we saw in this presentation and as you can see, all of them are currently available for CDFMC. However, well, currently all of these for the on prem version, if you have on prem fmcs or the 1st requirements.37:05To have this FMC registered with security cloud control so you can have access to AI OPs.37:25And this is it is also required that your fmcs are running specific versions for you to have access to to some of these for instance like the policy analyzer and optimizer is available on seven four, but it doesn't include the NAT analyzer option up until seven six. The.37:32But the answer like best practice and recommendations is only available on an FMC version current version ten.37:52As well as feature adoption insights and user risk insights. So let's make sure that we plan upgrades for our on prem fmcs if we are interested in using any of these features.37:59So I've dropped here this just as kind of like a awareness of what's been tested right now. These are best these are better features that are currently in testing mode. So this will be possibly added in the future. They are not still committed on.38:15To a specific version, they may not be committed to any version.38:35But as you can see, these are, this is what we are like basically playing with and trying to see if there is actually value on including these features and feature releases compliance posture. It's, it's meant to automatically evaluate.38:38Firewall configurations against supported compliance requirements and identify areas that may require attention and by highlighting compliance gaps and potential risks and provide actionable guidance to help maintain a compliance.38:56And secure deployment. And workforce is basically uses a specialized agents to assist with operational workflows such as VPN troubleshooting, traffic remediation like with elephant flow agents in this case.39:11And policy analy analysis basically you with the agent workforce, you can interact with agents conversationally just like with an LLM to investigate issues and review your recommendations and perform guided operational tasks with these agents.39:27Again, these better features are still in testing phase. They are, they can be accessed over CDFMC only as of today. Alright, so the prerequisites for AI ops.39:45It requires that your FMC is at least version seven.two. However, the recommended version is seven.six and and your FMC on prem must be integrated on with security cloud control. This is for.40:05And on prem fmcs. No licenses required, it comes as part of your security cloud control based subscription, and if you have your regular smart licenses are ready with your managed devices on your on prem FMC, that you that should give you also access.40:21This to these AI OP features with any additional charge.40:41Right, that being said, I appreciate your your time and I thank you for, your attention on this presentation. Thank you Alexander. Is there any questions I haven't seen any so far? Give it just a minute or so.40:47All right, well thank you again for spending time with us on this topic, and please complete the survey be able to look out for a question and answer email and enjoy the rest of your day.41:07