Recurring Geolocation Updates - Source fire Sourcefire 3D System Installation Manual

Setting Up a Sourcefire 3D System Appliance
Initial Setup Page: Defense Centers
Version 5.2

Recurring Geolocation Updates

S D C
UPPORTED EFENSE
You can use most Defense Centers to view geographical information about the
routed IP addresses associated with events generated by the system, as well as
monitor geolocation statistics in the dashboard and Context Explorer.
The Defense Center's geolocation database (GeoDB) contains information such
as an IP address's associated internet service provider (ISP), connection type,
proxy information, and exact location. Enabling regular GeoDB updates ensures
that the system uses up-to-date geolocation information. If you plan to perform
geolocation-related analysis in your deployment, Sourcefire recommends that you
Enable Recurring Weekly Updates.
You can specify the weekly update frequency for the GeoDB. Click the time zone
to change it using a pop-up window. To download the database as part of the
initial configuration process, select Install Now.
IMPORTANT! GeoDB updates may be large and may take up to 45 minutes to
install after download. You should update the GeoDB during periods of low
network use.
Automatic Backups
The Defense Center provides a mechanism for archiving data so configurations
can be restored in case of failure. As part of the initial setup, you can Enable
Automatic Backups.
Enabling this setting creates a scheduled task that creates a weekly backup of the
configurations on the Defense Center.
License Settings
You can license a variety of features to create an optimal Sourcefire 3D System
deployment for your organization. A FireSIGHT license on the Defense Center is
required to perform host, application, and user discovery. Additional
Sourcefire 3D System Installation Guide
: Any except DC500
ENTERS
Chapter 4
105