Which Firepower Report Combines Intrusion, Malware, and Security Intelligence Events?
Due to an increase in malicious events, a security engineer must generate a threat report to include intrusion events, malware events, and security intelligence events. How is this information collected in a single report?
Community Insight
Tests whether you know that FMC predefined reports are each bound to a single event family, so only a multi-section Custom report can union IPS, malware, and security intelligence events; the trap is assuming a shipped 'default Firepower' or 'Attacks Risk' report already covers everything.
Firepower Management Center custom reports are the only report type that can merge intrusion, malware, and security intelligence event data into one threat report. This page explains why creating a Custom report (B) satisfies the requirement while the default Firepower, malware, and Attacks Risk reports cannot span all three event families.
Picking A or D — the default Firepower and Attacks Risk reports are IPS/impact-flag scoped, so they contain no malware or security intelligence event data and cannot deliver the three-event-type report the engineer needs.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A Cisco Firepower Management Center custom report is built from a template plus one or more report sections, and each section is a query against a chosen event type such as intrusion (IPS), malware, security intelligence, connection, or discovery. Because the engineer must deliver one document containing intrusion events, malware events, and security intelligence events, the report has to combine several event-type sections — exactly what the custom report builder is designed for. No predefined FMC report spans those tables, so option B is the only construct that meets the stated requirement. Hence answering a Custom report is correct.Why the Other Options Are Wrong
Option A fails because the shipped default reports (Attacks, Malware, Discovery, and similar) are each scoped to a single event family, so none of them merges IPS, malware, and security intelligence data. Option C, a malware report, only presents file/malware events and would omit the intrusion and security intelligence information entirely. Option D, the Attacks Risk Report, is an intrusion-risk summary: as CrashRTX describes it, the fields are "Total Attacks" and "Relevant Attacks" based on IPS impact flags, plus hosts targeted and events requiring attention — useful for IPS trending, but it carries no malware or security intelligence events. All three alternatives therefore cover only part of the requested scope.Community Comment Notes
donciga states plainly that "A Custom report allows the engineer to combine multiple event types into a single document," which is the decisive point of this question. CrashRTX instead discusses the Attacks Risk Report's field list (Total Attacks, Relevant Attacks, Hosts Targeted), confirming that it is an IPS-scoped report rather than the multi-source artifact the stem asks for. Doris8000 adds only a brief "makes sense" in agreement with the custom report answer. The community reading aligns with the vendor's report architecture, so B stands.Exam Strategy
On FMC reporting items, first count the event types named in the stem: if it is exactly one, a predefined report may fit, but as soon as two or more distinct event families appear, 'custom report' is almost always the intended answer. Memorize the two building blocks of a custom report — template plus per-event-type sections — and the predefined report names (Attacks, Malware, Attacks Risk) so you can eliminate them quickly under time pressure. Never let the word 'default' in an option convince you a single shipped report aggregates unrelated event tables.Exam Strategy
Count the distinct event types in the stem before looking at the answers: one event family can map to a predefined FMC report, but two or more (IPS plus malware plus security intelligence) can only be satisfied by a Custom report with multiple sections. Memorize that predefined reports such as Attacks, Malware, and Attacks Risk are each single-purpose, which makes them fast distractors to eliminate.
Frequently Asked Questions
Why can't the default Firepower or Attacks Risk report serve as the threat report here?
Predefined FMC reports are scoped to one event family — the Attacks Risk Report summarizes IPS impact-flag data only — so they cannot include malware or security intelligence events.
What does building a Custom report in Firepower Management Center involve?
You choose a report template and add sections, each section a query against a specific event type such as intrusion, malware, or security intelligence, then run or schedule it.