Chapter 4 of 4 · Cisco CCNP 300-710 SNCF
Integration
Overview of the SNCF Integration chapter covering Malware Defense, Secure Endpoint, TID, Cisco XDR, pxGrid, containment, analytics and logging, and Splunk.
- 8topics
- 33 minfast track
- 1diagrams and exhibits
- 15%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Malware Defense and File PoliciesLearn how Malware Defense uses file policies, cloud lookup, dispositions, dynamic analysis and retrospective events to detect and…5 min
- 2Secure Endpoint IntegrationLearn how Cisco Secure Endpoint integrates with the FMC through the cloud, what data is shared, and how endpoint and network…4 min
- 3Threat Intelligence DirectorLearn how Threat Intelligence Director brings third party STIX and flat file feeds into Secure Firewall as observables, with…4 min
- 4Cisco XDR for Security InvestigationsUnderstand how Cisco XDR gathers telemetry from Secure Firewall and other tools, builds incidents, and supports investigation…4 min
- 5FMC Integration with ISE Using pxGridLearn how the FMC uses pxGrid to subscribe to Cisco ISE session data, how certificate trust is set up, and how identity and…4 min
- 6Rapid Threat ContainmentLearn how Rapid Threat Containment links FMC correlation rules to ISE adaptive network control so that an infected endpoint is…Diagram4 min
- 7Security Analytics and LoggingUnderstand Security Analytics and Logging, why firewall events go to remote storage, the on premises and cloud options, and how…4 min
- 8Splunk Integration and AI Driven Threat IntelligenceLearn how Secure Firewall events reach Splunk by eStreamer or syslog, and how Cisco Talos intelligence and machine learning…4 min
About this chapter
What this chapter covers
Integration is about connecting Secure Firewall to other products so that each one makes the others more useful.
It covers file and malware protection, the link to endpoint protection, outside threat feeds, investigation in the cloud, sharing identity with ISE, automatic containment, long term logging and analysis in Splunk.
The chapter follows the Integration objectives for the CCNP 300-710 SNCF exam, which are 4.1 to 4.8 in the question bank.
How the topics fit together
Some integrations bring information in, some send events out, and some let the firewall trigger an action elsewhere.
The first group brings knowledge to the firewall. Malware Defense looks up file verdicts, Secure Endpoint adds what the host sees, and Threat Intelligence Director adds your own third party feeds.
The second group takes events out. Cisco XDR correlates them across products. Security Analytics and Logging keeps a long history, and Splunk gives analysts a search platform.
The third group acts. The pxGrid page shows how the FMC learns identity from ISE. The Rapid Threat Containment page then shows how the same link lets the FMC ask ISE to quarantine an endpoint.
Several of these features need licences and a cloud connection. Plan connectivity first, because most problems start there.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the usual traps.
- Check yourself: three questions to test your understanding.
Read the pxGrid page before the Rapid Threat Containment page, because the second builds on the first. The Malware Defense page is a good place to start the chapter.
Ready for more practice?
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.