Cisco Cisco Firepower Management Center 4000
37-30
FireSIGHT System User Guide
Chapter 37 Using Host Profiles
Working with User-Defined Host Attributes
To set pre-defined host attributes in the host profile:
Access:
Admin/Security Analyst
Step 1
Open the host profile for the host for which you want to set a business criticality.
Step 2
Next to
Attributes
, click the pencil icon (
).
The Host Attributes pop-up window appears.
Step 3
Form the
Host Criticality
drop-down list, select the value you want to apply:
None
,
Low
,
Medium
, or
High
.
Step 4
Click
Save
.
Your selection is saved.
Working with User-Defined Host Attributes
License:
FireSIGHT
The FireSIGHT System includes two predefined host attributes, host criticality and host notes, that you
can use to indicate the business criticality of the hosts on your network. If you have other criteria that
you would like to use to identify your hosts, you can create user-defined host attributes.
can use to indicate the business criticality of the hosts on your network. If you have other criteria that
you would like to use to identify your hosts, you can create user-defined host attributes.
User-defined host attributes appear in the host profile page, where you can assign values on a per-host
basis. You can then use those attributes in correlation policies and searches. You can also view the
attributes on the host attribute table view of events and generate reports based on them.
basis. You can then use those attributes in correlation policies and searches. You can also view the
attributes on the host attribute table view of events and generate reports based on them.
Note
Host attributes are defined globally rather than per policy. After you create a host attribute, it is available
regardless of the policy applied.
regardless of the policy applied.
Some examples of user-defined host attributes include:
•
assigning physical location identifiers to hosts, such as a facility code, city, or room number.
•
assigning a Responsible Party Identifier that indicates which system administrator is responsible for
a given host. You can then craft correlation rules and policies to send alerts to the correct system
administrator when problems related to a host are detected.
a given host. You can then craft correlation rules and policies to send alerts to the correct system
administrator when problems related to a host are detected.
Host attributes can be text strings or values selected from predefined lists of text or ranges of numbers.
You can also automatically assign values to hosts from a predefined list based on the hosts’ IP addresses.
You can use this feature to automatically assign values to new hosts when they appear on your network
for the first time.
You can also automatically assign values to hosts from a predefined list based on the hosts’ IP addresses.
You can use this feature to automatically assign values to new hosts when they appear on your network
for the first time.
Host attributes can be one of the following types:
Text
Allows you to manually assign a text string up to 255 characters to a host.
Integer
Allows you to specify the first and last number of a range of positive integers, then manually assign
one of these numbers to a host.
one of these numbers to a host.