Cisco Cisco Firepower Management Center 4000

Page of 1844
 
37-17
FireSIGHT System User Guide
 
Chapter 37      Using Host Profiles
  Working with Servers in the Host Profile
  –
FireSIGHT
FireSIGHT
 
Port Match
, or 
FireSIGHT Pattern Match
, for Cisco-detected 
applications
  –
NetFlow
, for servers added to the network map based on NetFlow data 
The system may reconcile data from multiple sources to determine the identity of a server; see 
To view the server detail for a server:
Access: 
Admin/Any Security Analyst
Step 1
Click the view icon (
) next to a server in the 
Servers
 section of a host profile.
The Server Detail pop-up window appears.
Editing Server Identities
License: 
FireSIGHT
You can manually update the identity settings for a server on a host and configure any fixes that you have 
applied to the host to remove the vulnerabilities addressed by the fixes. You can also delete server 
identities.
Note that deleting an identity does not delete the server, even if that is the only identity. Deleting an 
identity does remove the identity from the Server Detail pop-up window and, if applicable, updates the 
current identity for the server in the host profile. 
You cannot edit or delete server identities added by a Cisco-managed device.
To edit the server identity:
Access: 
Admin/Any Security Analyst
Step 1
In the 
Servers
 section in a host profile, click 
View
 to open the Server Detail pop-up window.
Step 2
You have two options:
  •
To delete a server identity, click the delete icon (
) next to the server identity you want to remove.
  •
To modify a server identity, click the edit icon (
) next to the server in the servers list. 
The Server Identity pop-up window appears. 
Step 3
You have two options:
  •
Select the current definition from the 
Select Server Type
 drop-down list.
  •
Select the type of server from the 
Select Server Type
 drop-down list. 
Step 4
Optionally, to only list vendors and products for that server type, select the 
Restrict by Server Type
 check 
box. 
Step 5
Optionally, to customize the name and version of the server, select the 
Use Custom Display String
 and type 
Vendor String
 and 
Version String
Step 6
In the 
Product Mappings
 section, select the operating system, product, and versions you want to use.
For example, if you want the server to map to Red Hat Linux 9, select 
Redhat, Inc.
 as the vendor, 
Redhat 
Linux
 as the product, and 
9
 as the version.