FMC signature update

[xili5]

Hello,

I got some questions from customer about FMC signature update(local malware analysis and file preclassification signature updates) . What I could find in document about this signature update is that, by default, automatic update is enable and FMC checks for signature updates once every 30 minutes.

But questions are related to very detailed process and I am very appreciated if I could get answer of below questions.

1. Can FMC manually update the signature? What is the best practice of signature update?
2. Is there any Portal or Mail services to notify the customer for when/what signature applied?
3. How can we exclude the specific signature on FirePower to be applied
4. What is frequency of signature update, do we have any statistics for signature update frequency?

br,

Martin

[yasirirfan]

Dear Xin Li

• Can FMC manually update the signature? What is the best practice of signature update?

Yes FMC is capable of updating the signature manually. So far its hard to find a best security practice documents from Cisco. Based on experience the signature updates should be automatically done.

You can refer to following link for more details

Firepower Management Center Configuration Guide, Version 6.0 - System Software Updates [Cisco Firepower Management Cen…

• Is there any Portal or Mail services to notify the customer for when/what signature applied?

You can fine tune the FMC using the custom report part no sure about the signature.

• How can we exclude the specific signature on FirePower to be applied

Simple don't update the specific signature your don't want and this url can further guide you Firepower Management Center Configuration Guide, Version 6.0 - System Software Updates [Cisco Firepower Management Cen…

• What is frequency of signature update, do we have any statistics for signature update frequency?

You have an option to chose the update daily, weekly or monthly and even you can customise the updates to the particular day of the week.

Hope this will help you

Cheers

Yasir

[xili5]

Hi Yasir,

Thank you for your quick reply.

But unfortunately I can't find any word of signature update(local malware analysis and file preclassification signature updates) in your url.

what i mentioned is about the setting of "Enable Automatic Local Malware Detection Updates". so maybe there is misunderstanding from you.

[yasirirfan]

Got it , if I found more details I will update you.