Cisco Cisco Firepower Management Center 2000

To configure the agent, you can take any of the actions described in 

FireSIGHT

You can define up to 500 user names to be excluded when polling for login or logoff events. If the agent 
retrieves a login or logoff event by an excluded user name, the agent does not report the event to the 
Defense Center. Login and logoff events for a user name that are reported before the exclusion are not 
affected. If you remove a user name from the excluded user name list, future login and logoff events for 
that user name are reported to the Defense Center.

You can choose whether to exclude all logins and logoffs by a user from all domains, or from specific 
domains. You can also export and import lists of user names and domains, stored in comma-separated 
value files. Note that if you exclude a user already reported to the Defense Center, the user is never 
unmapped from the host, unless the host is purged from the database.

Any

Select the 

tab.

In the next available row, type a user name you want to exclude in the 

 column.

Excluded user names cannot include the dollar sign character (

$

) or the quotation mark character (

"

).

Optionally, type the domain associated with the user name in the 

 column. You can only define 

one domain per row. If you do not specify any domain, the user name in every domain is excluded.

Repeat steps 

 and 

 to add additional user names. If you have more than one excluded user name 

configured, you can sort on 

 or 

by clicking on the respective column headers.

To remove a row, you have the following options:

Highlight the row and press the Delete key.

Place your pointer at the end of the user name and press the Backspace key until it is deleted. 

The row is removed. 

To remove multiple rows, Ctrl-click to select multiple rows and press the Delete key.

To export the list of user names and domains to a comma-separated value file, click 

. Select a 

file path to save the file.

The file is saved. By default, the file is named 

Sourcefire_user_agent_excluded_users.csv

. 

To import a list of user names and domains from a comma-separated value file, click 

. Select a 

file to upload.

The existing user names are cleared, and the user names in the file are loaded. You cannot upload a file 
that contains duplicate user names. If there are any syntax errors in the file, you cannot upload the file.

Entries in the comma-separated value file must be in the following format:

"user name","domain"

A domain value is optional, but quotes are required as a placeholder.

Click 

to save and apply configuration changes to the agent.