Time different event data together to identify compromised hosts and drop actors can be challenging
with next generation devices like firepower.
You can easily map data together like IP addresses DNS requests and HTP you are Elle's.
Now let's hop in the lab and we'll take a look at how you could use firepower event information to identify
compromised hosts and threat actors on your network by simulating a malicious connection
for example.
I'm going to use a malware test link to trigger a blocked connection on the network.
I like to use the W I see our DOT Oregon test site which I will provide the link for in the resources
for this lecture.
It just has a collection of some downloadable payloads that you can use to test to make sure that your
malware defenses are working properly.
So if I click on the last virus here of course I get blocked since my Firepower device is doing what
it's supposed to be doing.
And you can see here actually I didn't even get a chance to connect to each TTP site to download the
test file because firepower blocked the actual DNS request to resolve the IP address of this Web site
where I would download the virus.
So I'm actually going to disable my DNS blocks so that we see all the connection information to help
us analyze the connection.
So to disable these security intelligence DNS blocks Lingula policies access control and then DNS
and then I'll just disable these DNS blacklist rules.
Just as a temporary thing for example
save it and now deploy the new policy to my Firepower sensor in the lab and then I'll start the video
back up.
Once that's done deploying and then we should be able to resolve the task the miller site so that we
get a full picture of the connections traversing the fire power devices
OK now that the policy has successfully been pushed to my Firepower device I should be able to resolve
the web page that is going to be used to download the test payload here.
So let me try it again.
OK.
So it was still blocked but let's see if I am at least able to resolve it.
All right there you go so that tells me that D-Nice is along the connection through but my you are l
filtering blacklist blocked the connection so that's good.
My device is doing what it's supposed to be doing.
Let's go to analyze connections and events.
And then I added it in my search to filter on anything destined to be IP address that I resolved for
malware dot w.
I see our dot org and as you can see here I see my host IP address as the potentially compromised host
destined to the threat actor IP address as the responder IP and the Web site where the malware was attempted
to be downloaded from malware.
W I ca our dot org.
And then the file name.
So right here in this one line I have the compromise host throughout actor and the HTP data so that
I know what site was trying to be accessed from the compromised host.