steps to enable IPS on FMC/FTD

Update to latest recommended version

Update snort rules (vrt) to latest version

Define and configure HOME_NET and EXTERNAL_NET (objects -> env variables / variable set)

HOME_NET = 192.168.1.0/24

EXTERNAL_NET =  not HOME_NET

Create IPS pol with log only action

Apply to ACP rules

Let run for a week

Review for false positives and resolve

Set IP pol to drop action

Test/Review again

Keep going until you can increase security to the max but not generate FP's

You can investigate rules, get the SID

Edit the IPS pol, search the rules for the SID

Look up documentation / CVE

Check for the code which triggers the rule

You can go back to the events, download packets and check what the traffic was, why it hit that rule etc

Clearing cache for cisco amp

Some times you might get a false positive. Cisco will update their signatures but you might have one in your cache. To make the alert go away you have to clear cache update and scan again, it should come up clean.


Removal of the FireAMP Cache and History Files on Windows
https://www.cisco.com/c/en/us/support/docs/security/sourcefire-fireamp-endpoints/118565-technote-fireamp-00.html#anc1


Clear Cache firepower FMC/sensor

Follow following steps to clear cache on DC and Sensor (from CSCuu81183):

Management Center:
SSH into the Management Center
Become root: sudo su -
# pmtool restartbyid SFDataCorrelator
# pmtool disablebyid SFDataCorrelator
# cd /etc/sf
# rm malw_cache_seed_file.dc
# pmtool enablebyid SFDataCorrelator

Firepower Device:
SSH into the Firepower device
Become root: sudo su -
# pmtool restartbyid SFDataCorrelator
# pmtool disablebyid SFDataCorrelator
# cd /etc/sf
# rm malw_cache_seed_file.sensor
# pmtool enablebyid SFDataCorrelator
# pmtool restartbytype snort
# pmtool disablebytype snort
# cd /var/sf/detection-engines/<uuid> (you can find the UUID for this step by running de_info.pl and copying the UUID for the Primary Detection Engine)
# rm -rf instance?*/malw_seed*
# pmtool enablebytype snort