Configure Correlation Policy on FMC

Introduction

This document describes the procedure to configure a Correlation Policy to connect events and detect anomalies on your network.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these products:

• Secure Firewall Management Center (FMC)
• Secure Firewall Threat Defense (FTD)

Components Used

The information in this document is based on these software and hardware versions:

• Firepower Threat Defense for VMware version 7.6.0

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Correlation Policies are used to identify potential security threats on your network by configuring different types of events, and are used for remediation, conditional alerts, and traffic policies.

Configure

Configure Correlation Rules

Step 1. Navigate to Policies > Correlation and select Rule Management.

Image 1. Navigation to Correlation Policy Menu

Step 2. Create a new rule by selecting Create Rule.

Image 2. Rule Creation on Rule Management Menu

Step 3. Select an event type and the conditions to match the rule.

When your rule contains multiple conditions, you must link them with AND or an OR operator.

Image 3. Rule Creation Menu

Note: Correlation Rules must not be generic, if the rule is constantly triggered by normal traffic, this can consume additional CPU and affect FMC performance.

Configure Alerts

Step 1. Navigate to Policies > Actions > Alerts.

Image 4. Navigation to Alerts Menu

Step 2. Select Create Alert and create either a Syslog, SNMP or email alert.

Image 5. Create Alert

Step 3. Verify the alert is enabled.

Configure Correlation Policy 

Step 1. Navigate to Policies > Correlation.

Navigation to Correlation Policy Menu

Image 6. Navigation to Correlation Policy Menu

Step 2. Create a new Correlation Policy. Select the default priority. Use None to use the specific rules' priorities.

Image 7. Create New Correlation Policy

Step 3. Add rules to the policy by selecting Add Rules.

Image 8. Add Rules and Select Priority for Correlation Policy

Image 9. Select Rules to Add to the Correlation Policy

Step 4. Assign a response to the rule from the alerts you created, so whenever it is triggered, it sends the selected alert type.

Image 10. Add Responses' Button

Image 11. Assign Responses to Correlation Rule

Step 5. Save and enable your Correlation Policy.

Image 12. Response Added Correctly to the Correlation Rule

Image 13. Enable Correlation Policy