WEBVTT

00:00:01.520 --> 00:00:03.570
[Autogenerated] let's hop on the Cisco secure train.

00:00:03.570 --> 00:00:08.660
Now, specifically, we'll talk about Cisco's secure firewall solution.

00:00:09.440 --> 00:00:11.900
This was previously known as firepower,

00:00:11.900 --> 00:00:15.860
threat defense and it fully integrates Snort two or three into the product

00:00:15.920 --> 00:00:21.180
depending on the versions the snort inspection engine gives the secure firewall

00:00:21.180 --> 00:00:24.910
very comprehensive Next gen firewall capabilities.

00:00:25.030 --> 00:00:28.170
Not only does it integrate very tightly with the traditional

00:00:28.170 --> 00:00:31.450
firewall features but the reporting capabilities,

00:00:31.510 --> 00:00:35.390
intelligence integration and the ease of rural management

00:00:35.400 --> 00:00:38.540
make the product work very effectively when managing it

00:00:38.550 --> 00:00:40.520
with the secure firewall manager.

00:00:41.250 --> 00:00:45.610
As you can see, Snort is right here in this firewalls traffic flow chart.

00:00:46.300 --> 00:00:49.220
This means that the LeNA engine which is similar to the

00:00:49.220 --> 00:00:51.550
traditional firewall phase processes.

00:00:51.550 --> 00:00:55.330
The packets first then passes them to snort and back to lena.

00:00:56.110 --> 00:00:58.600
When using snort with secure firewall,

00:00:59.020 --> 00:01:02.410
you can create multiple inspection policies to send the data

00:01:02.410 --> 00:01:05.830
to snort on a per firewall rule basis.

00:01:06.150 --> 00:01:09.000
You can control if you want to inspect the packets or not,

00:01:09.890 --> 00:01:13.190
you get very granular rule management capabilities that

00:01:13.190 --> 00:01:15.640
easily allow you to override the defaults,

00:01:15.650 --> 00:01:20.070
create custom rules and use recommendations that can be

00:01:20.070 --> 00:01:21.940
generated based on the traffic scene.

00:01:22.820 --> 00:01:25.750
This product also gives you the ability to create

00:01:25.760 --> 00:01:28.560
remediation actions to help automate the response.

00:01:29.340 --> 00:01:33.200
Using snore with secure firewall also provides a lot of context

00:01:33.200 --> 00:01:36.260
capabilities as a result of the application detectors,

00:01:36.880 --> 00:01:41.800
you're able to use this information to allow or block specific applications

00:01:41.800 --> 00:01:45.340
in the traffic visibility is crucial in today's networks.

00:01:45.430 --> 00:01:49.240
So this information can be used for threat hunting and

00:01:49.240 --> 00:01:54.690
investigations as well and then tie in the platform with other

00:01:54.690 --> 00:01:58.000
security products for more streamlined investigations,

00:01:58.010 --> 00:02:02.200
response at orchestration and additional context sharing,

00:02:02.210 --> 00:02:05.820
and you'll be set up with an effective security ecosystem.

00:02:06.420 --> 00:02:09.979
One thing that I really like about this integration is that

00:02:09.979 --> 00:02:12.960
you can investigate the intrusion events right from the

00:02:12.960 --> 00:02:14.400
management centers dashboard.

00:02:14.920 --> 00:02:20.010
The system automatically prioritizes and classifies the events to

00:02:20.010 --> 00:02:23.490
assist in triage while you're investigating them.

00:02:23.810 --> 00:02:27.620
You're able to actually download the packets for the event in question to

00:02:27.620 --> 00:02:30.460
try to look at exactly what happened to cause the alert.

00:02:31.290 --> 00:02:34.370
You'll see an example of this capability in the coming demo.

00:02:35.420 --> 00:02:39.090
There's so many nuances that use information from snore in this

00:02:39.090 --> 00:02:42.140
system that it really is tightly integrated.