Anyone have a play book on investigation via FPMC?

[babiojd01]

I was interested in if anyone had a playbook they could share as it pertains to FirePower Managment center? If no playbooks can anyone share what their steps are as to:

1. What you personally investigate first? Impact 1?, IOC, Malware alerts...

2. What Cisco Recommends whats investigated first?

3. Cisco documentation on recommended steps for analysis?

[riccardosl]

Hello,

I didn't found any useful documentation, I can advice to look in other books but in general I would say

Impact 1 and Impact 2 events not blocked

[babiojd01]

What would stop an impact 1 or 2 event from being blocked? A Signature set to alert only?

[riccardosl]

Each signature can be set in Drop/Generate events/Disable state , depends how you configure it