41-3
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter41 Configuring Global Correlation
Understanding Global Correlation
Using reputation scores to adjust the risk rating of an event improves the efficacy of the sensor by
improving the following metrics:
•False positives as a percentage of actionable events.
•False negatives as a percentage of threats that do not result in actionable events.
•Actionable events as a percentage of all events.
Related Topics
•Understanding Global Correlation, page 41-1
•Understanding Network Participation, page 41-3
•Configuring Global Correlation Inspection and Reputation, page 41-5
•Configuring Network Participation, page41-7
Understanding Network Participation
Network participation lets Cisco collect nearly real-time data from sensors around the world. Sensors
installed at customer sites can send data to the SensorBase Network. These data feed in to the global
correlation database to increase reputation fidelity. Communication between sensors and the SensorBase
Network involves an HTTPS request and response over TCP/IP.
There are three modes for Network Participation:
•Off—The Network Participation server does not collect data, track statistics, or try to contact the
Cisco SensorBase network.
•Partial Participation—The Network Participation server collects data, tracks statistics, and
communicates with the SensorBase network. Data considered to be potentially sensitive is filtered
out and never sent.
Note Configuring the sensor for partial network participation limits a third party from extracting
reconnaissance information about your internal network from the global correlation
database.
•Full Participation—The Network Participation server collects data, tracks statistics, and
communicates with the SensorBase network. All data collected is sent.
If you select partial or full participation, you are prompted to accept a participation agreement. You must
accept the agreement to participate or you cannot change the participation mode.
The following table explains the data collected and the purpose of collecting it.