Cisco Cisco Firepower Management Center 4000

Page of 1844
 
40-12
FireSIGHT System User Guide
 
Chapter 40      Creating Traffic Profiles 
  Understanding Condition-Building Mechanics
The following steps explain how to build this host profile qualification.
To build this host profile qualification:
Access: 
Admin/Discovery Admin 
Step 1
Select 
Policies > Correlation
, then click 
Traffic Profiles
.
The Traffic Profiles page appears.
Step 2
Click 
New Profile
.
The Create Profile page appears.
Step 3
Click 
Add Host Profile Qualification
.
Step 4
Under 
Host Profile Qualification
, in the first condition, specify the host whose information you want to 
collect.
In this example, select 
Responder Host
 because we only want information on responding hosts in a 
connection.
Step 5
Begin specifying the details of the operating system of the host by choosing the 
Operating System
 
category.
Three subcategories appear: 
OS Vendor
OS Name
, and 
OS Version
Step 6
To specify that the host can be running any version of Microsoft Windows, use the same operator for all 
three subcategories: 
is
.
Step 7
Finally, specify the values for the subcategories.
Select 
Microsoft
 as the value for 
OS Vendor
Windows
 as the value for 
OS Name
, and leave 
any
 as the value 
for 
OS Version
.
Note that the categories you can choose from depend on whether you are building traffic profile 
conditions or a host profile qualification. In addition, a condition’s available operators depend on the 
category you choose. Finally, the syntax you can use to specify a condition’s value depends on the 
category and operator. Sometimes you must type the value in a text field. Other times, you can pick a 
value from a drop-down list.
Note
Where the condition syntax allows you to pick a value from a drop-down list, you can often use multiple 
values from the list. For more information, see