Cisco Cisco Firepower Management Center 4000

Page of 1844
 
38-29
FireSIGHT System User Guide
 
Chapter 38      Working with Discovery Events
  Working with Host Attributes
Step 4
Optionally, add notes to the host profiles of the hosts you selected by entering up to 255 alphanumeric 
characters, special characters, and spaces in the text box.
Step 5
Optionally, set any user-defined host attributes you have configured.
Step 6
Click 
Save
.
The host attributes you specified are assigned to the selected hosts.
Searching for Host Attributes
License: 
FireSIGHT
You can search for hosts that have specific host attributes. For example, if your company has several 
regional offices, you could configure a host attribute that tells you which city any one host resides in. 
You could then search for hosts in specific regions. For more information on host attributes, see 
.
You may want to create searches customized for your network environment, then save them to reuse later. 
For more information on the host attribute fields, see 
General Search Syntax
The system displays examples of valid syntax next to each search field. When entering search criteria, 
keep the following points in mind:
  •
All fields accept negation (
!
).
  •
All fields accept comma-separated lists. If you enter multiple criteria, the search returns only the 
records that match all the criteria.
  •
Many fields accept one or more asterisks (
*
) as wild cards.
  •
For some fields, you can specify 
n/a
 or 
blank
 in the field to identify events where information is not 
available for that field; use 
!n/a
 or 
!blank
 to identify the events where that field is populated.
  •
Most fields are case-insensitive.
  •
IP addresses may be specified using CIDR notation. For information on entering IPv4 and IPv6 
addresses in the FireSIGHT System, se
.
  •
Click the add object icon (
) that appears next to a search field to use an object as a search 
criterion. 
For detailed information on search syntax, including using objects in searches, see 
.
To search for host attributes:
Access: 
Admin/Any Security Analyst
Step 1
Select 
Analysis > Search
.
The Search page appears.
Step 2
From the 
Table
 drop-down list, select 
Host Attributes
.
The page reloads with the appropriate constraints.