Cisco Cisco Firepower Management Center 4000

The user identity (username) of the currently logged in user on the host. 

Note that when a non-authoritative user logs into a host, that login is recorded in the user and host 
history. If no authoritative user is associated with the host, a non-authoritative user can be the current 
user for the host. However, after an authoritative user logs into the host, only a login by another 
authoritative user changes the current user. In addition, when a non-authoritative user is the current 
user on a host, that user still cannot be used for user control.

The number of events that match the information that appears in each row. Note that the Count field 
appears only after you apply a constraint that creates two or more identical rows.

FireSIGHT

You can search for hosts that are running specific clients, application protocols, or web applications. You 
may want to create searches customized for your network environment, then save them to reuse later. 

The system displays examples of valid syntax next to each search field. When entering search criteria, 
keep the following points in mind:

All fields accept negation (

!

).

All fields accept comma-separated lists. If you enter multiple criteria, the search returns only the 
records that match all the criteria.

Many fields accept one or more asterisks (

*

) as wild cards.

For some fields, you can specify 

n/a

 or 

blank

 in the field to identify events where information is not 

available for that field; use 

!n/a

 or 

!blank

 to identify the events where that field is populated.

Most fields are case-insensitive.

IP addresses may be specified using CIDR notation. For information on entering IPv4 and IPv6 
addresses in the FireSIGHT System, see 

.

Click the add object icon (

) that appears next to a search field to use an object as a search 

criterion. 

For detailed information on search syntax, including using objects in searches, see 

.

Admin/Any Security Analyst

Select 

.

The Search page appears.

From the 

 drop-down list, select 

.

The page reloads with the appropriate constraints.