Cisco Cisco Firepower Management Center 4000

Click the add object icon (

) that appears next to a search field to use an object as a search 

criterion. 

For detailed information on search syntax, including using objects in searches, see 

.

Admin/Any Security Analyst

Select 

.

The Search page appears.

From the 

 drop-down list, select 

.

The page reloads with the appropriate constraints.

To search the database for a different kind of event, select it from the 

 drop-down list.

Optionally, if you want to save the search, enter a name for the search in the 

 field.

If you do not enter a name, the Defense Center automatically creates one when you save the search.

Enter your search criteria in the appropriate fields, as described in 

. If you enter multiple criteria, the Defense Center returns only the 

records that match all the criteria. Click the add icon (

) that appears next to a search field to use an 

object as a search criterion.

If you want to save the search so that other users can access it, clear the 

 check box. 

Otherwise, leave the check box selected to save the search so that only you can use it. 

If you want to save a search as a restriction for custom user roles with restricted privileges, you must 
save it as a private search.

You have the following options:

Click 

 to start the search.

Your search results appear in the default IOC workflow. To use a different workflow, including a 
custom workflow, click 

. For information on specifying a different default 

workflow, see 

. 

Click 

 if you are modifying an existing search and want to save your changes.

Click 

 to save the search criteria. The search is saved (and associated with your 

user account if you selected 

), so that you can run it at a later time.

FireSIGHT