Integration · Topic 3 of 8
Threat Intelligence Director
Learn how Threat Intelligence Director brings third party STIX and flat file feeds into Secure Firewall as observables, with monitor or block actions.
- 4 min
- TID collects third party intelligence in the FMC and publishes it to devices.
- Sources can be STIX over TAXII, or flat files.
- Observables include addresses, domains, URLs and file hashes.
What it is
Threat Intelligence Director (TID) takes threat data from outside sources and turns it into enforcement on your firewalls.
Many organisations receive lists of bad addresses, domains, URLs and file hashes from partners, industry groups or their own tools. TID collects them in the Secure Firewall Management Center (FMC) and pushes them to the managed devices.
The devices then monitor or block matching traffic, and the FMC records incidents when something matches.
How it works
TID has a small set of terms, and the flow from source to action follows them in order.
The building blocks
| Term | What it is |
|---|---|
| Source | Where intelligence comes from, such as a TAXII server or a file |
| Indicator | A description of a threat, which contains one or more observables |
| Observable | A single item to match, such as an address, a URL, a domain or a file hash |
| Action | What the device does on a match, either monitor or block |
| Element | A device that receives the observables |
| Incident | The record created when traffic matches an observable |
Sources
A source can be a STIX feed delivered through a TAXII server. The FMC polls the server on an update schedule. STIX is a format for describing threats, and TAXII is the way it is exchanged.
A source can also be a flat file. It is a simple text list that you upload or that the FMC downloads from a location. Flat files carry one type of observable per file, such as a list of IP addresses.
You can add your own feeds as well as commercial and shared ones. You can set a default action for a source, and you can change the action for single indicators.
Observables and actions
The observable types include IP addresses, domain names, URLs and file hashes. The FMC publishes them to devices, and the devices then inspect traffic for matches.
For each one, the action is monitor or block. Monitor records a match and lets the traffic through. Block stops it.
Start with monitor for a new feed, look at the matches, then block when you trust the feed.
Publishing to devices
TID has to be turned on in its settings. You choose the devices that take part. The FMC then sends the data to the devices, and you can see the status of that process.
Devices need to run a version that supports TID. The access control policy must be in place on the device so that matches can be acted on.
Incidents
When traffic matches an observable, the FMC creates an incident. The incident shows the observable, the action taken and the connection details. Analysts use the incident list to find and follow up.
If a match is wrong, you can turn off the indicator so it stops matching. This keeps a noisy feed under control.
TID and Security Intelligence
Cisco Talos feeds are used by Security Intelligence in the access control policy. TID is for the other feeds, which you choose yourself.
Both act early in the processing of a connection, but they are separate features with separate lists.
Good practice
Check the quality of a feed before you block on it. Watch the update schedule, because an old feed gives old data. Keep the number of observables sensible, since very large lists use device resources.
What to remember for the exam
Seven facts cover the usual questions.
- TID collects third party intelligence in the FMC and publishes it to devices.
- Sources can be STIX over TAXII, or flat files.
- Observables include addresses, domains, URLs and file hashes.
- The action for each item is monitor or block.
- A match creates an incident in the FMC.
- TID is separate from Security Intelligence, which uses Cisco feeds.
- Start with monitor before you block a new feed.
When a question talks about importing a partner list of bad IP addresses into the firewalls, think of TID with a flat file or a STIX source.
Common mistakes
These four mistakes are common with TID.
Blocking on day one. A new feed may contain false positives, so monitor first.
Confusing TID with Security Intelligence. TID is for your own sources, and Security Intelligence uses Cisco feeds.
Forgetting to choose devices. Observables only reach the devices you select.
Using a stale feed. Check the update schedule and the age of the data.
A bad entry in a feed can block legitimate traffic. Use monitor first, and keep a way to disable an indicator quickly.
Check yourself
Work through these three questions.
Which two source types can TID use?
A STIX feed delivered through a TAXII server, and a flat file.
What actions can TID take on a matching observable?
It can monitor, which records the match, or block, which stops the traffic.
What does the FMC create when traffic matches an observable?
It creates an incident that records the observable, the action and the connection.
Topic 3 of 8 in Integration
Test yourself on Integration
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.