Integrate a Cisco Firepower On-Premises Device

Configure a Cisco Firepower on-premises device to pull IOCs from Threat Command.

The following table shows device-specific integration characteristics:

Limitations

The Cisco Firepower integration is subject to the following limitations:

• The Cisco Firepower Threat Intelligence Director (TID) must enabled on the Cisco Management Center.
• URLs that contain port, protocol, or authentication information, and that also use the normalized version when detecting indicators are normalized. For example, TID normalizes any of the following URLs to google.com/index.htm: http://google.com/index.htm, http://google.com:8080/index.htm, google.com:8080/index.htm, or google.com/index.htm
  Or, for example, TID normalizes http://abc@google.com:8080/index.htm as abc@google.com/index.htm/

For additional limitations, see the Cisco Firepower documentation.

To integrate the device, perform these steps (described in the following sections):

1. Add the device to the Threat Command virtual appliance.
2. Configure the device to pull IOCs from Threat Command.

Add a Cisco Firepower on-premises device

The procedure to add the device to Threat Command is different depending on the version of the Threat Command virtual appliance in your environment. To determine which version is running, see Determine the Version of Virtual Appliance.

Add the on-premises device

Configure a Cisco Firepower device to pull IOCs

After a device has been added to the Threat Command virtual appliance, you must enable it to pull IOCs from Threat Command.

Configuration for on-premises devices

When configuring an on-premises device, it is important to know which version of the Threat Command virtual appliance is running in your environment. This will affect which Rapid7 URL is displayed in the Device Details screen and also which URL to copy into the device management console.

When running version 4.0 or later, the Legacy URL should be used only with Rapid7 support.

To determine which version of the virtual appliance is running, see Determine the version of virtual appliance.

Prerequisites

• You have the device login credentials.
• The device has been added.
• You have administrative credentials to access Threat Command with a subscription to the Automation and TIP modules.
• An IOC group for this device exists in Threat Command.
  Creating IOC groups is described in Create an IOC group

To configure a Cisco Firepower device:

1. From Threat Command, copy the Cisco Firepower IOC group URL into the Cisco Firepower Management Center:
   1. From the Threat Command main menu, select Automation > Integrations.
   2. From the On-Premises device list, select the Cisco Firepower device.
   3. Click the link icon to the far right of the device IOC group.
      
   4. From the IOC Group URLdialog, copy the URL:
      • For virtual appliance v4.0 or later: Use the IOC Group URL.
      • For virtual appliance v3.9 or earlier: Use the Legacy URL.
2. Log in to the Cisco Firepower Management Center.
3. Navigate to Intelligence > Sources.
4. In the top right, click + to add a new source.
   The Add Source dialog is displayed.
5. In the Add Source dialog, fill the fields, as follows:
   1. For Delivery, select URL.
   2. For Type, select Flat File.
   3. In the URL field, paste the IOC group URL from Threat Command.
   4. In the Content drop-down, select the content type that matches the content of the IOC group (for example, Domain, URL, or IPs).
   5. Type a user-defined name.
   6. To begin pulling IOCs immediately, select Publish.
   7. Click Save.
6. To verify that IOCs are being pulled into the Cisco Firepower console, navigate to Intelligence > Sources > Sources. The Status will be displayed as Completed.
   This could take some time. Refresh to synchronize the status. You can use the Cisco Firepower Management Center Indicators and Observables tabs to drill down in the IOCs and to perform related activities.