Cisco Cisco Firepower Management Center 4000
38-14
FireSIGHT System User Guide
Chapter 38 Working with Discovery Events
Working with Discovery and Host Input Events
Host Attribute Delete
This event is generated when a user deletes a user-defined host attribute.
Host Attribute Delete Value
This event is generated when a user deletes a value assigned to a host attribute.
Host Attribute Set Value
This event is generated when a user sets a host attribute value for a host.
Host Attribute Update
This event is generated when a user changes the definition of a user-defined host attribute.
Set Host Criticality
This event is generated when a user sets or modifies the host criticality value for a host.
Set Operating System Definition
This event is generated when a user sets the operating system for a host.
Set Server Definition
This event is generated when a user sets the vendor and version definitions for a server.
Set Vulnerability Impact Qualification
This event is generated when a vulnerability impact qualification is set.
When a vulnerability is disabled at a global level from being used for impact qualifications, or when
a vulnerability is enabled at a global level, this event is generated.
a vulnerability is enabled at a global level, this event is generated.
Vulnerability Set Invalid
This event is generated when a user invalidates (or reviews) a vulnerability or vulnerabilities.
Vulnerability Set Valid
This event is generated when a user validates a vulnerability that was previously marked as invalid.
Viewing Discovery and Host Input Events
License:
FireSIGHT
Both discovery events and host input events can be viewed using Discovery Events workflows.
Discovery events record the detection of network discovery data based on the configured network
discovery policy for an appliance. Host input events record the input of host data into the network map
through the host input feature. For more information, see
Discovery events record the detection of network discovery data based on the configured network
discovery policy for an appliance. Host input events record the input of host data into the network map
through the host input feature. For more information, see
and
.
You can use the Defense Center to view a table of discovery or host input events. Then, you can
manipulate the event view depending on the information you are looking for.
manipulate the event view depending on the information you are looking for.
The page you see when you access events differs depending on the workflow you use. You can use the
predefined workflow, which includes the table view of discovery events and a terminating host view
page. You can also create a custom workflow that displays only the information that matches your
specific needs. For information on creating a custom workflow, see
predefined workflow, which includes the table view of discovery events and a terminating host view
page. You can also create a custom workflow that displays only the information that matches your
specific needs. For information on creating a custom workflow, see