AMENDMENT NO. 1

Exhibit 10.4

AMENDMENT NO. 1

TO

PARTICIPATION AGREEMENT

     This Amendment No. 1 to the Participation Agreement of Thomas M. McDonough (the “Amendment”), effective March 31, 2011, is made by and between Sourcefire, Inc., a Delaware corporation (the “Company”), and Thomas M. McDonough (the “Executive”).

     Whereas, the Company and Executive entered into that certain letter agreement effective August 25, 2008, establishing a Participation Agreement pursuant to the Sourcefire, Inc. Executive Change in Control Severance Plan (the “Participation Agreement”); and

     Whereas, the Company and the Executive desire to amend the Participation Agreement.

     Now Therefore, in consideration of the promises and mutual covenants herein and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Company and the Executive agree as follows:

1. Section 1(d) of the Participation Agreement is amended to read, in its entirety, as follows:

     Definition and Interpretation of Good Reason. As provided by Section 6.2 of the Plan, the definition of “Good Reason” found in Section 2.10 of the Plan shall be deleted in its entirety and replaced with the following:

“‘Good Reason’ shall mean (i) a material decrease in the Participant’s Base Salary and/or Target Bonus, (ii) a material reduction or material adverse change in the Participant’s authority, duties, title or, job responsibilities, or reporting structure, (iii) a geographic relocation of the Participant without his or her consent more than thirty (30) miles from the current location of his or her office as of the date hereof), or (iv) a willful and continued material breach by the Company of this Agreement or the ‘Assignment of Inventions, Non-Disclosure, Non-Solicitation and Non-Competition Agreement’ that has a material adverse effect on the Participant; provided, however, that any proposed Termination of Employment by the Participant shall be presumed to be other than for Good Reason, unless the Participant first provides written notice to the Company within ninety (90) days following the effective date of such event, and the Company has been provided a

period of at least thirty (30) days after receipt of the Participant’s notice during which to cure, rescind or otherwise remedy the actions, events, or circumstances described in such notice. The Participant’s Termination of Employment shall not be considered to be for Good Reason unless it occurs no more than one hundred and twenty (120) days following the initial occurrence of the purported Good Reason event(s) as described above”.

     Notwithstanding any contrary provision in the Plan or this Participation Agreement, the parties acknowledge and agree that the reassignment of managerial authority over the Company’s Information Technology and Operations Department from you to the Company’s Chief Financial Officer shall not constitute Good Reason.

2. Except as herein amended, the Participation Agreement is hereby ratified, confirmed and affirmed for all purposes and in all respects.

     In Witness Whereof, the undersigned parties have executed this Amendment as of the date first written above.