Which Firepower Report Combines Intrusion, Malware, and Security Intelligence Events?

300-710 By islever Editorial Last updated

Configure dashboards and reporting in Secure Firewall Management Center Analyze risk and standard reports such as events (connection, discovery, intrusion, malware, and unified) and network map

Short answer

B Create a Custom report in FMC, which is the only report type that can combine intrusion, malware, and security intelligence events into one threat report.

Question

Due to an increase in malicious events, a security engineer must generate a threat report to include intrusion events, malware events, and security intelligence events. How is this information collected in a single report?
  1. Run the default Firepower report.
  2. Create a Custom report. Correct Answer
  3. Generate a malware report.
  4. Export the Attacks Risk report.

Key Takeaways

Tests whether you know that FMC predefined reports are each bound to a single event family, so only a multi-section Custom report can union IPS, malware, and security intelligence events; the trap is assuming a shipped 'default Firepower' or 'Attacks Risk' report already covers everything.

Firepower Management Center custom reports are the only report type that can merge intrusion, malware, and security intelligence event data into one threat report. This page explains why creating a Custom report (B) satisfies the requirement while the default Firepower, malware, and Attacks Risk reports cannot span all three event families.

Common mistake: Picking A or D — the default Firepower and Attacks Risk reports are IPS/impact-flag scoped, so they contain no malware or security intelligence event data and cannot deliver the three-event-type report the engineer needs.

Expert Analysis

Why the Answer Is Correct

A Cisco Firepower Management Center custom report is built from a template plus one or more report sections, and each section is a query against a chosen event type such as intrusion (IPS), malware, security intelligence, connection, or discovery. Because the engineer must deliver one document containing intrusion events, malware events, and security intelligence events, the report has to combine several event-type sections — exactly what the custom report builder is designed for. No predefined FMC report spans those tables, so option B is the only construct that meets the stated requirement. Hence answering a Custom report is correct.

Why the Other Options Are Wrong

Option A fails because the shipped default reports (Attacks, Malware, Discovery, and similar) are each scoped to a single event family, so none of them merges IPS, malware, and security intelligence data. Option C, a malware report, only presents file/malware events and would omit the intrusion and security intelligence information entirely. Option D, the Attacks Risk Report, is an intrusion-risk summary: as CrashRTX describes it, the fields are "Total Attacks" and "Relevant Attacks" based on IPS impact flags, plus hosts targeted and events requiring attention — useful for IPS trending, but it carries no malware or security intelligence events. All three alternatives therefore cover only part of the requested scope.

Community Comment Notes

donciga states plainly that "A Custom report allows the engineer to combine multiple event types into a single document," which is the decisive point of this question. CrashRTX instead discusses the Attacks Risk Report's field list (Total Attacks, Relevant Attacks, Hosts Targeted), confirming that it is an IPS-scoped report rather than the multi-source artifact the stem asks for. Doris8000 adds only a brief "makes sense" in agreement with the custom report answer. The community reading aligns with the vendor's report architecture, so B stands.

Exam Strategy

On FMC reporting items, first count the event types named in the stem: if it is exactly one, a predefined report may fit, but as soon as two or more distinct event families appear, 'custom report' is almost always the intended answer. Memorize the two building blocks of a custom report — template plus per-event-type sections — and the predefined report names (Attacks, Malware, Attacks Risk) so you can eliminate them quickly under time pressure. Never let the word 'default' in an option convince you a single shipped report aggregates unrelated event tables.

Exam Strategy

Count the distinct event types in the stem before looking at the answers: one event family can map to a predefined FMC report, but two or more (IPS plus malware plus security intelligence) can only be satisfied by a Custom report with multiple sections. Memorize that predefined reports such as Attacks, Malware, and Attacks Risk are each single-purpose, which makes them fast distractors to eliminate.

Frequently Asked Questions

Why can't the default Firepower or Attacks Risk report serve as the threat report here?

Predefined FMC reports are scoped to one event family — the Attacks Risk Report summarizes IPS impact-flag data only — so they cannot include malware or security intelligence events.

What does building a Custom report in Firepower Management Center involve?

You choose a report template and add sections, each section a query against a specific event type such as intrusion, malware, or security intelligence, then run or schedule it.

More 300-710 FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. CrashRTX 👍 1 Answered B
    Attacks Risk Report. The following are the fields in this report: Total Attacks—The total number of IPS events. Relevant Attacks—The number of IPS events with impact flag equal to 1. Hosts Targeted—The number of unique destination IP addresses from IPS events ​with impact flag equal to 1. Irrelevant Attacks—The percentage of IPS events with impact ​flag not equal to 1. Events Requiring Attention—The percentage of IPS events with impact flag equal to 1. Hosts Connected to CnC Servers—​The total number of unique hosts with the IOC category: "CnC Connected."
  2. donciga 👍 1 Answered B
    A Custom report allows the engineer to combine multiple event types into a single document for better analysis.
  3. Doris8000 👍 1
    makes sense

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Changing FTD from Routed to Transparent Mode

S-grade

How Do You Isolate BVI Traffic on a Routed FTD?

S-grade

Cisco FTDv Licensing Model Valid Statements

S-grade

Duo and RTC for FTD Remote Access VPN

S-grade

← Back to 300-710 Study Guide