Configuring Cisco Talos Intelligence for FTD and WSA
Short answer
A Configure the integrations with Talos intelligence to take advantage of the threat intelligence that it provides.
Question
for URL filtering, reputations, and vulnerability information that can be integrated with the Cisco FTD and Cisco WSA. What must be done to accomplish these
objectives?
Key Takeaways
The core concept tested is identifying the primary vendor-specific threat intelligence feed integrated natively with Cisco security appliances, avoiding third-party or irrelevant standards bodies.
This question addresses the integration of threat intelligence into Cisco Secure Firewall (FTD) and Web Security Appliance (WSA). It establishes that Cisco Talos is the native, most current source for URL filtering, reputation data, and vulnerability information required for these objectives.
Common mistake: Candidates often select pxGrid (Option D) because it is a valid mechanism for sharing intelligence, but they fail to recognize that NIST is not the direct provider of real-time operational threat feeds for FTD/WSA configuration in this context.
Expert Analysis
Why the Answer Is Correct
Cisco Talos Intelligence Group is Cisco's dedicated threat intelligence team responsible for collecting, analyzing, and disseminating real-time security data. As noted by user Alizade, Talos provides the specific URL filtering, reputation, and vulnerability data that can be directly ingested by Cisco Firepower Management Center (FMC), which then pushes policies to FTD and WSA. The official documentation confirms that FDM/FMC utilizes Talos feeds for Security Intelligence policies.
Why the Other Options Are Wrong
Option B is incorrect because the IETF defines internet standards (RFCs) and does not provide dynamic operational threat feeds for firewalls. Option C refers to the Internet Storm Center, which is part of Kaspersky Labs; while useful, it is not the native 'most current' solution integrated out-of-the-box with Cisco appliances compared to Talos. Option D suggests using pxGrid to connect to NIST; as user haiderzaid clarified, pxGrid is a protocol for sharing intelligence between platforms, but NIST publishes static databases (like CVEs) rather than the real-time actionable threat feeds needed for immediate firewall blocking.
Community Comment Notes
User iluvmicrosoft highlights that FDM primarily relies on Talos, reinforcing the exclusivity of the answer. User XBfoundX correctly points out that Security Intelligence policies use Talos feeds to drop unwanted traffic before access control evaluation. User Premium_Pils provided the official Cisco configuration guide link validating Talos integration.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
When configuring Cisco security appliances, always prioritize native vendor integrations for core functions like threat intelligence. Remember that Cisco Talos is the proprietary engine powering URL filtering and reputation services across the Cisco security portfolio.
Frequently Asked Questions
Can FTD use third-party threat feeds instead of Talos?
What is the role of pxGrid in this scenario?
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
iluvmicrosoft 👍 3I also agree its A I think the point here is current intelligence that can be ingested into FTD and WSA we know that FMC can use talos AND/OR 3rd party feeds.. (and then push the data to FTD) I found a post somewhere (wish i could find it) that stated FDM can only use talos also if you read up on how WSA gets its intelligence data, it states talos and i cannot find anything that says it can get 3rd party feeds - if these are both true then answer is not B NOR C as they can only use talos..
-
Alizade 👍 3 Answered ATherefore, the answer is A.
-
Premium_Pils 👍 2 Answered Ahttps://www.cisco.com/c/en/us/td/docs/security/firepower/623/fdm/fptd-fdm-config-guide-623/fptd-fdm-sec-intel.html ->Read this!
-
XBfoundX 👍 1 Answered AThe Security Intelligence policy gives you an early opportunity to drop unwanted traffic based on source/destination IP address or destination URL. The system drops this unwanted traffic before evaluating it with the access control policy, thus reducing the amount of system resources used. You can block traffic based on the following: Cisco Talos Intelligence Group (Talos) feeds—Talos provides access to regularly updated security intelligence feeds. Sites representing security threats such as malware, spam, botnets, and phishing appear and disappear faster than you can update and deploy custom configurations. The system downloads feed updates regularly, and thus new threat intelligence is available without requiring you to redeploy the configuration.
-
haiderzaid 👍 1pxGrid enables third party platforms to share threat intelligence , in another word ,pxGrid can be used for integration, it is not specifically related to importing information from NIST.
Show 1 more comment
-
surforlife 👍 1Why not use pxGrid?
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.