Remediations

Requirements and prerequisites for remediations

This section lists the requirements and prerequisites before you implement security remediations.

Requirement

Supported values

Model support

Any

Supported domains

Any

User roles

  • Admin

  • Discovery Admin

Introduction to remediations

A remediation is a program that

  • launches in response to a correlation policy violation,

  • generates a remediation status event when it runs, and

  • includes details such as the remediation name, the correlation policy and rule that triggered it, and the exit status message.

Supported remediation modules

The system supports several remediation modules:

  • Cisco ISE Adaptive Network Control (ANC): Applies or clears ANC policies configured in Cisco ISE when a correlation policy violation occurs.

  • Cisco IOS Null Route: Blocks traffic sent to a host or network involved in a correlation policy violation (requires Cisco IOS Version 12.0 or higher).

  • Nmap Scanning: Scans hosts to determine the operating systems and servers running on them.

  • Set Attribute Value: Sets a host attribute on a host involved in a correlation policy violation.


Tip

You can install custom modules to perform additional tasks. Refer to Firepower System Remediation API Guide.

Implementing remediations

To implement a remediation:

  • Create at least one instance for the remediation module you choose. Multiple instances can be created per module, each with unique configurations. For example, configure multiple instances of the Cisco IOS Null Route module to communicate with different routers.

  • Add multiple remediations to each instance to specify the actions to be performed when a policy is violated.

  • Associate remediations with rules in correlation policies so that the system launches the appropriate remediation in response to a violation.

Remediations and multitenancy

In a multidomain deployment, you can install custom remediation modules at any domain level. The system-provided modules belong to the Global domain.

Though you cannot add a remediation to an instance created in an ancestor domain, you can create a similarly configured instance in the current domain and add remediations to that instance. You can also use remediations created in ancestor domains as correlation responses.

Cisco ISE EPS remediations

If you have Endpoint Protection Service (EPS) enabled and configured in your ISE deployment, you can configure your Firewall Management Center to launch remediations using ISE. When fully configured, ISE EPS remediations run the following Mitigation Actions on the source or destination host involved in a correlation policy violation:

  • quarantine—Limits or denies an endpoint's access the network.

  • unquarantine—Reverses an endpoint's quarantine status and allows full access to the network.

  • shutdown—Deactivates an endpoint's network attached system (NAS) port to disconnect it from the network.

Exempt specific IP addresses from ISE EPS remediation if needed.


Note

Your ISE version and configuration impact how you can use ISE. For example, you cannot use ISE-PIC to perform ISE EPS remediations. For more information, see the User Control with ISE/ISE-PIC chapter in the Cisco Secure Firewall Management Center Device Configuration Guide.

For more information about ISE EPS actions, see the Cisco Identity Services Engine User Guide.

Configure ISE EPS remediations

You can respond to correlation policy violations by running ISE EPS remediations on the source or destination host.


Note

ISE PIC cannot perform ISE EPS remediations.

Before you begin

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

Add a pxGrid mitigation instance as described in Add an ISE EPS instance.

Step 3

Add one or more ISE EPS remediations as described in Add ISE EPS remediations.

What to do next

Assign remediations as responses to correlation policy violations as described in Add responses to rules and allow lists.

Add an ISE EPS instance

Add an ISE EPS instances so you can group individual remediations by logging type.

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

From the Add a New Instance list, choose pxGrid Mitigation(v1.0) as the module type and click Add.

Step 3

Enter an Instance Name and Description.

Step 4

Set Enable Logging option to enable or disable system logging.

Step 5

Click Create.

What to do next

Create an ISE EPS remediation as described in Add attribute value remediations.

Add ISE EPS remediations

Create one or more ISE EPS remediations within an instance to run Mitigation Actions on the source or destination host involved in a correlation policy violation.

In a multidomain deployment, you cannot add a remediation to an instance created in an ancestor domain.

Before you begin

Create an ISE EPS instance as described in Add an ISE EPS instance.

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

Next to the instance where you want to add the remediation, click View (View button).

Step 3

In the Configured Remediations section, choose the Mitigate Destination or Mitigate Source and click Add.

If the controls are dimmed, the configuration belongs to an ancestor domain, or you do not have permission to modify the configuration.

Step 4

Enter a Remediation Name and Description.

Step 5

Choose a Mitigation Action: quarantine, unquarantine, or shutdown.

Step 6

(Optional) To exempt IP addresses or ranges from remediation, enter them into the Allow List box.

Step 7

Click Create, then click Done.

What to do next

Assign remediations as responses to correlation policy violations; see Add responses to rules and allow lists.

Cisco IOS null route remediations

The Cisco IOS Null Route remediation module allows you to block an IP address or range of addresses using Cisco’s “null route” command. This drops all traffic sent to a host or network by routing it to the router’s NULL interface. This does not block traffic sent from the violating host or network.

Important considerations


Note

Do not use a destination-based remediation as a response to a correlation rule that is based on a discovery or host input event. These events are associated with source hosts.


Caution

When a Cisco IOS remediation is activated, there is no timeout period. To unblock the IP address or network, you must manually clear the routing change from the router.

Configure remediations for Cisco IOS routers

This task configures remediation responses on Cisco IOS routers that automatically block traffic when correlation policies are violated.

Cisco IOS remediations provide automated responses to security events detected by correlation rules. You can configure different types of blocking remediations based on your security requirements.


Note

Do not use a destination-based remediation as a response to a correlation rule that is based on a discovery or host input event. These events are associated with source hosts.


Caution

When a Cisco IOS remediation is activated, there is no timeout period. To unblock the IP address or network, you must manually clear the routing change from the router.

Before you begin

  • Confirm that your Cisco router is running Cisco IOS 12.0 or higher.

  • Confirm that you have level 15 administrative access to the router.

Procedure

Step 1

Enable Telnet on your Cisco router. Refer to the documentation provided with your router or IOS software for instructions.

Step 2

Add a Cisco IOS Null Route instance for each Cisco IOS router you want to use in Firewall Management Center. For more information, refer to Add a Cisco IOS instance.

Step 3

Create remediations for each instance based on the response you want the router to perform when correlation policies are violated:

What to do next

Assign remediations as responses to correlation policy violations; see Add responses to rules and allow lists.

Add a Cisco IOS instance

Add a Cisco IOS instance to enable remediation actions on routers through the management system.

If you have multiple routers where you want to send remediations, create a separate instance for each router.

Before you begin

Configure Telnet access on the Cisco IOS router as described in the documentation provided with the router or IOS software.

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

From the Add a New Instance list, choose Cisco IOS Null Route and click Add.

Step 3

Enter an Instance Name and Description.

Step 4

In the Router IP field, enter the IP address of the Cisco IOS router you want to use for the remediation.

Step 5

In the Username field, enter the Telnet user name for the router. This user must have level 15 administrative access on the router.

Step 6

In the Connection Password fields, enter the Telnet user's user password.

Step 7

In the Enable Password fields, enter the Telnet user's enable password. This is the password used to enter privileged mode on the router.

Step 8

In the Allow List field, enter IP addresses or ranges that you want to exempt from the remediation, one per line.

Note

 

The system builds a separate network map for each leaf domain. In a multidomain deployment, using literal IP addresses to constrain this configuration can have unexpected results.

Step 9

Click Create.

What to do next

Add specific remediations to be used by correlation policies as described in Add Cisco IOS block destination remediations, Add Cisco IOS block destination network remediations, Add Cisco IOS block source remediations, and Add Cisco IOS block source network remediations.

Add Cisco IOS block destination remediations

The Cisco IOS Block Destination remediation blocks traffic sent from the router to the destination host involved in a correlation policy violation. Do not use this remediation as a response to a correlation rule that is based on a discovery or host input event, as these events are associated with source hosts.

In a multidomain deployment, you cannot add a remediation to an instance created in an ancestor domain.

Before you begin

Add a Cisco IOS instance as described in Add a Cisco IOS instance.

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

Next to the instance where you want to add the remediation, click View (View button).

Step 3

In the Configured Remediations section, choose Block Destination and click Add.

If the controls are dimmed, the configuration belongs to an ancestor domain, or you do not have permission to modify the configuration.

Step 4

Enter a Remediation Name and Description.

Step 5

Click Create, then click Done.

What to do next

Assign remediations as responses to correlation policy violations; see Add responses to rules and allow lists.

Add Cisco IOS block destination network remediations

The Cisco IOS block destination network remediation blocks traffic sent from the router to the network of the destination host involved in a correlation policy violation.

Do not use this remediation as a response to a correlation rule that is based on a discovery or host input event, as these events are associated with source hosts.

In a multidomain deployment, you cannot add a remediation to an instance created in an ancestor domain.

Before you begin

Add a Cisco IOS instance as described in Add a Cisco IOS instance.

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

Next to the instance where you want to add the remediation, click View (View button).

Step 3

In the Configured Remediations section, choose Block Destination Network and click Add.

If the controls are dimmed, the configuration belongs to an ancestor domain, or you do not have permission to modify the configuration.

Step 4

Enter a Remediation Name and Description.

Step 5

In the Netmask field, enter the subnet mask or use CIDR notation to describe the network that you want to block traffic to.

For example, to block traffic to an entire Class C network when a single host triggers a rule (this is not recommended), use 255.255.255.0 or 24 as the netmask.

As another example, to block traffic to 30 addresses that include the triggering IP address, specify 255.255.255.224 or 27 as the netmask. In this case, if the IP address 10.1.1.15 triggers the remediation, all IP addresses between 10.1.1.1 and 10.1.1.30 are blocked. To block only the triggering IP address, leave the field blank, enter 32, or enter 255.255.255.255.

Step 6

Click Create, then click Done.

What to do next

Assign remediations as responses to correlation policy violations; see Add responses to rules and allow lists.

Add Cisco IOS block source remediations

The Cisco IOS Block Source remediation blocks traffic sent from the router to the source host involved in a correlation policy violation.

In a multidomain deployment, you cannot add a remediation to an instance created in an ancestor domain.

Before you begin

Add a Cisco IOS instance as described in Add a Cisco IOS instance.

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

Next to the instance where you want to add the remediation, click View (View button).

Step 3

In the Configured Remediations section, choose Block Source and click Add.

If the controls are dimmed, the configuration belongs to an ancestor domain, or you do not have permission to modify the configuration.

Step 4

Enter a Remediation Name and Description.

Step 5

Click Create, then click Done.

What to do next

Assign remediations as responses to correlation policy violations; see Add responses to rules and allow lists.

Add Cisco IOS block source network remediations

The Cisco IOS block source network remediation blocks traffic from the router to the network of the source host involved in a correlation policy violation.

In a multidomain deployment, you cannot add a remediation to an instance created in an ancestor domain.

Before you begin

Add a Cisco IOS instance as described in Add a Cisco IOS instance.

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

Next to the instance where you want to add the remediation, click View (View button).

Step 3

In the Configured Remediations section, choose Block Source Network and click Add.

If the controls are dimmed, the configuration belongs to an ancestor domain, or you do not have permission to modify the configuration.

Step 4

Enter a Remediation Name and Description.

Step 5

In the Netmask field, enter the subnet mask or CIDR notation that describes the network that you want to block traffic to.

For example, to block traffic to an entire Class C network when a single host triggers a rule (this is not recommended), use 255.255.255.0 or 24 as the netmask.

As another example, to block traffic to 30 addresses that include the triggering IP address, specify 255.255.255.224 or 27 as the netmask. In this case, if the IP address 10.1.1.15 triggers the remediation, all IP addresses between 10.1.1.1 and 10.1.1.30 are blocked. To block only the triggering IP address, leave the field blank, enter 32, or enter 255.255.255.255.

Step 6

Click Create, then click Done.

What to do next

Assign remediations as responses to correlation policy violations; see Add responses to rules and allow lists.

Nmap scan remediations

An Nmap scan remediation is a security response system that integrates with Nmap™, an open source active scanner for network exploration and security auditing, to trigger network scans when correlation policy violations occur.

Additional information

For more information about Nmap scanning, see Nmap Scanning.

Set attribute value remediations

The attribute value remediation is a response mechanism that sets a host attribute value on the host where a triggering event occurred when responding to a correlation policy violation.

Text host attributes

For text host attributes, you can use the description from the event as the attribute value.

Configure set attribute remediations

Configure set attribute remediations to address security or compliance issues by modifying device attributes.
Set attribute remediations allow you to modify specific attributes on managed devices to bring them into compliance with security policies or to address identified vulnerabilities.
Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

Create a set attribute instance as described in Add a set attribute value instance.

Step 3

Add a set attribute remediation as described in Add attribute value remediations.

What to do next

Assign remediations as responses to correlation policy violations; see Add responses to rules and allow lists.

Add a set attribute value instance

Set an attribute value instance to create customized remediation actions.

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

From the Add a New Instance list, choose Set Attribute Value and click Add.

Step 3

Enter an Instance Name and Description.

Step 4

Click Create.

What to do next

Create a set attribute remediation as described in Add attribute value remediations.

Add attribute value remediations

The set attribute value remediation sets a host attribute on a host involved in a correlation policy violation. Create a remediation for each attribute value you want to set. For text attributes, you can use the description from the triggering event as the attribute value.

In a multidomain deployment, you cannot add a remediation to an instance created in an ancestor domain.

Before you begin

Create a set attribute instance as described in Add a set attribute value instance.

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

Click View (View button) next to the instance where you want to add the remediation.

Step 3

In the Configured Remediations section, choose Set Attribute Value and click Add.

If the controls are dimmed, the configuration belongs to an ancestor domain, or you do not have permission to modify the configuration.

Step 4

Enter a Remediation Name and Description.

Step 5

To use this remediation in response to an event with source and destination data, choose an Update Which Host(s) From Event option.

Step 6

For text attributes, specify whether you want to Use Description From Event For Attribute Value:

  • To use the description from the event as the attribute value, click On and enter the Attribute Value you want to set.

  • To use the Attribute Value setting for the remediation as the attribute value, click Off.

Step 7

Click Create, then click Done.

What to do next

Assign remediations as responses to correlation policy violations; see Add responses to rules and allow lists.

Manage remediation modules

Manage remediation modules to control automated security responses and network remediation capabilities.

In a multidomain deployment, the system displays remediation modules installed in the current domain, which you can delete. It also displays modules installed in ancestor domains, which you cannot delete. To manage remediation modules in a lower domain, switch to that domain.

Procedure

Step 1

Choose Policies > Actions > Modules.

Step 2

Manage your remediation modules:

  • Configure — To view the Module Detail page for a module and configure its instances and remediations, click View (View button). In a multidomain deployment, you cannot use the Module Detail page to add, delete, or edit instances in the current domain for a module installed in an ancestor domain. Instead, use the Instances page (Policies > Actions > Instances); see Manage remediation instances.
  • Delete — To delete a custom module that is not in use, click Delete (delete icon). You cannot delete system-provided modules.
  • Install — To install a custom module, click Choose File, browse to the module, and click Install. For more information, see the Firepower System Remediation API Guide.

Manage remediation instances

This task allows you to add, configure, or delete remediation instances that control how the system responds to security events across all remediation modules.

The Instances page lists all configured instances for all remediation modules.

In a multidomain deployment, the system displays remediation instances created in the current domain, which you can edit. It also displays instances created in ancestor domains, which you cannot edit. To edit remediation instances in a lower domain, switch to that domain.

Although you cannot add a remediation to an instance created in an ancestor domain, you can create a similarly configured instance in the current domain and add remediations to that instance. You can also use remediations created in ancestor domains as correlation responses.

Procedure

Step 1

Choose Policies > Actions > Instances.

Step 2

Manage your remediation instances:

Manage instances for a single remediation module

Use the Module Detail page to manage all instances and remediations configured for a specific remediation module.

The Module Detail page displays all of the instances and remediations configured for a particular remediation module.

In a multidomain deployment, you can access the Module Detail page for remediation modules installed in the current domain and in ancestor domains. However, for modules installed in an ancestor domain, you cannot use the Module Detail page to add, delete, or edit instances in the current domain. Instead, use the Instances page ( Policies > Actions > Instances); see Manage remediation instances.

Procedure

Step 1

Choose Policies > Actions > Modules.

Step 2

Next to the remediation module whose instances you want to manage, click View (View button).

Step 3

Manage your remediation instances: