Configuration · Topic 4 of 9
Discovery, Detectors, Correlation and EVE
Learn how network discovery, application detectors, correlation and the Encrypted Visibility Engine give the FMC better host and threat awareness.
- 4 min
- Network discovery rules decide what is learned from which networks.
- The results appear in the network map.
- A custom application detector is created and then activated.
What it is
These four features help Secure Firewall learn what is on the network and react to what it sees.
Network discovery builds a map of hosts, users and applications from traffic.
Application detectors teach the firewall to recognise applications. Correlation turns events into alerts and actions. The Encrypted Visibility Engine (EVE) identifies applications and threats inside encrypted traffic.
All four are set up in the Secure Firewall Management Center (FMC) and work on data that the managed devices report.
How it works
Each feature has its own configuration, and they share the data that discovery collects.
Network discovery
A network discovery policy holds rules that say which networks to watch and what to learn. A rule can discover hosts, users and applications.
The result is the network map. It lists hosts with their operating system, applications and vulnerabilities, so that you know what you protect.
Other sources can add to the map. These include NetFlow exporters and host data you import. Discovery should cover your own address space and should leave out ranges you do not care about.
Application detectors
The firewall ships with many detectors from Cisco, and they update through the normal update process. A custom detector lets you add an application that is not known, such as an in house service.
A custom detector matches on patterns in the traffic and on ports. After you create it, you activate it, and then the new application can be used in rules and shows up in events.
Some applications are found by the built in detectors and others only through your own. You test a custom detector on traffic before relying on it.
Correlation
Correlation joins events and conditions into a response.
| Part | What it is |
|---|---|
| Correlation rule | The condition, such as an intrusion event with a given priority |
| Correlation policy | A group of rules, each tied to a response |
| Response | An action, such as an alert or a remediation |
A rule can trigger on event types such as connection, intrusion, malware, discovery, user activity and host input events. Responses include email, SNMP and syslog alerts. They also include remediation modules that act on another system, such as Cisco ISE.
A policy has to be activated before its rules run.
Encrypted Visibility Engine
Most traffic is encrypted. EVE looks at features of the TLS client hello, such as the fields the client offers. It uses them to guess the client application, even when the traffic is not decrypted.
EVE needs Snort 3 and a release that includes it, and you turn it on in the settings of the access control policy. It can add the detected process name to events. Newer releases can also use a threat confidence score for blocking.
EVE does not decrypt anything. It makes a good guess from what stays visible, and it works alongside a decryption policy rather than replacing one.
Comparing the features
| Feature | Main job |
|---|---|
| Network discovery | Learn hosts, users and applications |
| Application detector | Recognise one more application |
| Correlation | React to events with an alert or action |
| EVE | Identify clients in encrypted traffic |
What to remember for the exam
Seven facts cover the usual questions.
- Network discovery rules decide what is learned from which networks.
- The results appear in the network map.
- A custom application detector is created and then activated.
- A correlation rule is a condition, and a correlation policy ties rules to responses.
- A correlation policy must be activated.
- Correlation responses include alerts and remediation modules.
- EVE needs Snort 3 and classifies encrypted traffic without decrypting it.
When a question needs an automatic reaction to an intrusion event, such as an alert or a remediation, choose correlation.
Common mistakes
These four mistakes are common with these features.
Discovering everything. Include your own networks and exclude ranges that add noise.
Creating a rule but not activating the policy. The rule does nothing until its policy is active.
Thinking EVE decrypts traffic. It reads visible clues in the TLS handshake.
Forgetting to activate a custom detector. It will not be used until it is active.
EVE gives a likelihood, not proof. Test blocking by EVE score in a monitoring mode before you enforce it.
Check yourself
Work through these three questions.
What do you build to react to an intrusion event with an alert?
A correlation rule and a correlation policy that includes it and has a response, with the policy activated.
What does a custom application detector let you do?
It lets you add an application the firewall does not know, so it can be used in rules and events.
Does EVE decrypt traffic?
No. It identifies the client from visible parts of the TLS handshake and needs Snort 3.
Topic 4 of 9 in Configuration
Test yourself on Configuration
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.