10-2
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter10 Co nfiguring Global Correlation
Understanding Global Correlation
•
Global correlation inspection and the reputation filtering deny features do not support IPv6
addresses. For global correlation inspection, the sensor does not receive or process reputation data
for IPv6 addresses. The risk rating for IPv6 addr esses is not modified for global correlation
inspection. Similarly, network participation does not include event data for attacks from IPv6
addresses. And finally, IPv6 addresses do not appear in the deny list.
•
The sensor must operate in inline mode so that the global correlation features can increase efficacy
by being able to use the inline deny actions.
•
For global correlation to function, you must have either a DNS server or an HTTP proxy server
configured at all times.
Understanding Global Correlation
You can configure global correlation so that your sensors are aware of network devices with a reputation
for malicious activity, and can take action against them. Participating IPS devices in a centralized Cisco
threat database, the SensorBase Network, receive and absorb global correlation updates. The reputation
information contained in the global correlation updates is factored in to the analysis of networ k traffic,
which increases IPS efficacy, since traffic is denied or allowed based on the reputation of the source IP
address. The participating IPS devices send data back to the Cisco SensorBase Network, which results
in a feedback loop that keeps the updates current and global.
You can configure the sensor to participate in the global correlation updates and/or in sending telemetry
data or you can turn both services off. You can view reputation scores in events and see the reputation
score of the attacker. You can also view statistics from the reputation filter.
Participating in the SensorBase Network
The Cisco IPS contains a security c apability, Cisco Global Correlation, which uses the immense security
intelligence that we have amassed over the years. At regular intervals, the Cisco IPS receives threat
updates from the Cisco SensorBase Network, which contain detailed information about known threats
on the Internet, including serial attackers, Botnet harvesters, Malware outbreaks, and dark nets. The IPS
uses this information to filter out the worst attackers before they have a chance to attack critical assets.
It then incorporates the global threat data in to its system to detect and prevent malicious activity even
earlier.
If you agree to participate in the SensorBase Network, Cisco will collect aggregated statistics about
traffic sent to your IPS. This includes summary data on the Cisco IPS network traffic properties and how
this traffic was handled by the Cisco appliances. We do not collect the data content of traffic or other
confidential business or personal information. All data is aggregated and sent by secure HTTP to the
Cisco SensorBase Network servers in periodic intervals. All data shared with Cisco will be a nonymous
and treated as strictly confidential.