Cisco Cisco Firepower Management Center 4000

Page of 1844
 
40-9
FireSIGHT System User Guide
 
Chapter 40      Creating Traffic Profiles
  Editing a Traffic Profile
Deactivate a profile when you want it to stop collecting and evaluating connection data. Rules written 
against deactivated traffic profiles do not trigger. In addition, deactivating a traffic profile deletes all data 
collected and aggregated by the profile. If you later reactivate a deactivated traffic profile, you must wait 
the length of its PTW before rules written against it will trigger.
To activate or deactivate a traffic profile:
Access: 
Admin/Discovery Admin 
Step 1
Select 
Policies > Correlation
, then click 
Traffic Profiles
.
The Traffic Profiles page appears.
Step 2
You have two options:
  •
To activate an inactive traffic profile, click 
Activate
 next to the profile.
  •
To deactivate an active traffic profile, click 
Deactivate
 next to the profile. Confirm that you want to 
deactivate the profile by clicking 
OK
.
Editing a Traffic Profile
License: 
FireSIGHT
You cannot substantially edit an active traffic profile; if the traffic profile is active you can only change 
its name and description. To edit a traffic profile’s conditions options, you must first deactivate it. Note 
that deactivating a traffic profile deletes all the data it has collected.
For more information on activating and deactivating traffic profiles, see 
.
To edit a traffic profile:
Access: 
Admin/Discovery Admin 
Step 1
Select 
Policies > Correlation
, then click 
Traffic Profiles
.
The Traffic Profiles page appears.
Step 2
Next to the traffic profile you want to edit, click 
Edit
.
The Create Profile page appears.
Step 3
Make changes to the profile and click 
Save
.
Your profile is updated.
Understanding Condition-Building Mechanics
License: 
FireSIGHT
You build traffic profiles by specifying the conditions they use to collect data. You can create either 
simple conditions or more elaborate constructs with nested conditions.