Cisco Cisco Firepower Management Center 2000

Note that you can often use event data when constructing a host profile qualification. For example, 
assume your correlation rule triggers when the system detects the use of Internet Explorer on one of your 
monitored hosts. Further assume that when you detect this use, you want to generate an event if the 
version of the browser is not the latest (for this example, assume the latest version is 9.0).

You could add a host profile qualification to this correlation rule so that the rule triggers only if the 

 

is the 

 (that is, Internet Explorer), but the 

 is not 

9.0

.

FireSIGHT

A connection tracker constrains a correlation rule so that after the rule’s initial criteria are met (including 
host profile and user qualifications), the system begins tracking certain connections. The Defense Center 
generates a correlation event for the rule if the tracked connections meet additional criteria gathered over 
a time period that you specify.

If you are using a connection, intrusion, discovery, user activity, or host input event to trigger your 
correlation rule, you can add a connection tracker to the rule. You cannot add a connection tracker to a 
rule that triggers on a malware event or traffic profile change.

Client Category

Select a category.

Web Application

Select a web application.

Web Application Category

Select a category.

MAC Address > MAC 
Address

Type all or part of the MAC address of the host.

For example, if you know that devices from a certain hardware have MAC addresses that 
begin with 0A:12:34, you could choose 

 as the operator, then type 

0A:12:34

 as the 

value.

MAC Address > MAC Type

Select whether the MAC type is 

.

That is, select whether the system positively identified the MAC address as belonging to the 
host (

), whether the system is seeing many hosts with that MAC address 

because, for example, there is a router between the managed device and the host (

), or whether the MAC type is irrelevant (

).

MAC Vendor > 

 

MAC Vendor

Type all or part of the name of the MAC hardware vendor of the host.

any available host attribute, 
including the default 
compliance white list host 
attribute

Specify the appropriate value, which depends on the type of host attribute you select:

If the host attribute type is 

Integer

, enter an integer value in the range defined for the 

attribute. 

If the host attribute type is 

Text

, enter a text value.

If the host attribute type is 

List

, select a valid list string. 

If the host attribute type is 

URL

, enter a URL value.

For more information on host attributes, see