Management and Troubleshooting · Topic 5 of 6
Events, Risk Reports and the Network Map
Learn the Secure Firewall event types, impact levels, the network map and the standard risk reports, and how to follow an incident through them.
- 4 min
- Connection events record each logged connection with the rule and action.
- Intrusion events show a priority and an impact level.
- Impact level 1 means the target is known to be vulnerable.
What it is
Events are the records that Secure Firewall keeps, and the network map is the picture of the hosts they describe.
Each event type answers a different question. Connection events say who talked to whom. Intrusion events say what attack signature fired.
Malware events say what files were found. Discovery events say what changed on the network.
The Secure Firewall Management Center (FMC) stores them and lets you search, filter and report on them.
How it works
You pick the event type that fits the question, then filter and drill down.
Event types
| Event type | What it records |
|---|---|
| Connection | Each logged connection, with rule, action, application and bytes |
| Security Intelligence | Connections matched to a block or monitor list |
| Intrusion | A packet that matched an intrusion rule |
| File and malware | A file seen, with a disposition |
| Discovery | A new host, application or change on the network |
| Unified | A combined view of event types in one table |
Event pages are under the Analysis menu, and the exact names vary a little by release. The unified view lets you see connection and security events together, so you can follow one incident.
Connection events
A connection event shows the time, the addresses, the ports and the application. It shows the access control rule and the action, and the reason if the traffic was blocked.
Whether you see the event depends on rule logging. A rule can log at the start, at the end, or both, and the byte counts appear in an end of connection event.
Intrusion events
An intrusion event shows the rule that fired, the source and destination, and a priority of high, medium or low. It also shows an impact level that compares the attack with what the network map knows about the target.
| Impact | Meaning |
|---|---|
| 1 | The target is known to be vulnerable |
| 2 | The target may be vulnerable |
| 3 | The target is not currently vulnerable |
| 4 | The target host is not in the network map |
| 0 | Neither host is on a monitored network |
Impact 1 events deserve attention first, because the attack matches a weakness on the host.
Malware and file events
A file event records that a file was seen. A malware event adds a disposition, such as malware, clean, unknown or custom detection. A later change in verdict is also recorded.
The network map
The network map is built by network discovery. It lists hosts and their operating systems, applications, users and vulnerabilities.
Views let you list hosts by operating system, by application or by vulnerability. A host can also carry indications of compromise, which are flags that suggest it may be infected.
Risk and standard reports
Standard report templates summarise events for readers. Risk reports rank attack, malware and network risk, and they use the data from events and the network map.
Good reports depend on good data. Discovery has to cover the right networks, and logging has to be turned on in the rules.
Following an incident
Start with a high impact intrusion event. Open the host in the network map to learn what it is. Then look at the connection events for that host to see who it talked to, and at file events to see if malware arrived.
What to remember for the exam
Seven facts cover the usual questions.
- Connection events record each logged connection with the rule and action.
- Intrusion events show a priority and an impact level.
- Impact level 1 means the target is known to be vulnerable.
- Malware events carry a disposition such as malware, clean or unknown.
- The network map is built from network discovery.
- Indications of compromise flag hosts that may be infected.
- Unified events combine several event types in one view.
To decide which intrusion events to review first, look for impact level 1, because the target is known to be vulnerable.
Common mistakes
These four mistakes are common with events.
Expecting events from unlogged rules. Without rule logging there is no connection event.
Confusing priority and impact. Priority comes from the rule, and impact compares the attack with the target.
Trusting an empty network map. Discovery must cover the network for the impact data to be useful.
Looking only at intrusion events. Connection and file events complete the story.
Impact levels are only as good as the network map. A host that discovery has not seen shows an unknown impact.
Check yourself
Work through these three questions.
What does impact level 1 mean on an intrusion event?
The target host is known to be vulnerable to the attack, so the event should be reviewed first.
What builds the network map?
Network discovery, which learns hosts, operating systems, applications and vulnerabilities from traffic.
Which event type records the verdict on a file?
The malware event, which carries a disposition such as malware, clean or unknown.
Topic 5 of 6 in Management and Troubleshooting
Test yourself on Management and Troubleshooting
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.