Cisco Cisco Firepower Management Center 4000
38-17
FireSIGHT System User Guide
Chapter 38 Working with Discovery Events
Working with Discovery and Host Input Events
For detailed information on search syntax, including using objects in searches, see
.
Special Search Syntax for Discovery Events
The following table notes search information specific to particular discovery event fields. For more
information on discovery event fields, see
information on discovery event fields, see
To search for discovery events:
Access:
Admin/Any Security Analyst
Step 1
Select
Analysis > Search
.
The Search page appears.
Step 2
From the
Table
drop-down list, select
Discovery Events
.
The page reloads with the appropriate constraints.
Step 3
Optionally, if you want to save the search, enter a name for the search in the
Name
field.
If you do not enter a name, one is created automatically when you save the search.
Step 4
Enter your search criteria in the appropriate fields, as described in
and
If you enter multiple criteria, the search returns only the records that match all the criteria. Click the add
icon (
icon (
) that appears next to a search field to use an object as a search criterion.
Step 5
If you want to save the search so that other users can access it, clear the
Save As Private
check box.
Otherwise, leave the check box selected to save the search as private.
If you want to use the search as a data restriction for a custom user role, you must save it as a private
search.
search.
Step 6
You have the following options:
•
Click
Search
to start the search.
Your search results appear in the default discovery events workflow, constrained by the current time
range. To use a different workflow, including a custom workflow, click
range. To use a different workflow, including a custom workflow, click
(switch workflow)
. For
information on specifying a different default workflow, see
.
Table 38-3
Discovery Event Search Criteria Notes
Field
Search Criteria Notes
Event
The range of event names is listed in
and
MAC Vendor
To search for virtual MAC vendors, that is, for events that involve virtual machines, type
virtual_mac_vendor
.
To search for a vendor whose name includes a comma, enclose the entire search term in quotes.
Otherwise, the Defense Center treats the term as two searches and returns events that match each
search term.
Otherwise, the Defense Center treats the term as two searches and returns events that match each
search term.
Port
Note that you cannot:
•
enter a port/protocol combination as you can when searching for other kinds of events
•
use spaces when specifying port numbers or ranges.