Cisco Cisco Firepower Management Center 4000

43-22

FireSIGHT System User Guide

Chapter 43 Configuring Active Scanning

Working with Active Scan Results

Step 2

Click

Scan Results

The first page of the default scan results workflow appears. To use a different workflow, including a
custom workflow, click

(switch workflows)

by the workflow title. For information on specifying a different

default workflow, see

Configuring Event View Settings, page 58-3

Tip

If you are using a custom workflow that does not include the table view of scan results, click

(switch

workflows)

by the workflow title, then select

Scan Results

Step 3

You can perform the following actions:

•

To view the scan results as a rendered page in a pop-up window, click

View

next to the scan job.

•

To save a copy of the scan results file so that you can view the raw XML code in any text editor,
click

Download

next to the scan job.

Importing Scan Results

License:

FireSIGHT

You can import XML results files created by an Nmap scan performed outside of the FireSIGHT System.
You can also import XML results files that you previously downloaded from the FireSIGHT System. To
import Nmap scan results, the results file must be in XML format and adhere to the Nmap Version 1.01
DTD. For more information on creating Nmap results and on the Nmap DTD, refer to the Nmap
documentation at http://insecure.org. For information on downloading XML results from the FireSIGHT
System, see

Monitoring Scans, page 43-21

Note that a host must exist in the network map before Nmap can append its results to the host profile.

To import results:

Access:

Admin/Discovery Admin

Step 1

Select

Policies > Actions > Scanners

The Scan Instances page appears.

Step 2

On the toolbar, click

Import Results

The Import Results page appears.

Step 3

Click

Browse

to navigate to the results file.

Step 4

After you return to the Import Results page, click

Import

to import the results.

The results file is imported.

Searching for Scan Results

License:

FireSIGHT

You can search for Nmap or third-party scan results for any scans run on an appliance or managed
appliance in your FireSIGHT System.