Cisco Cisco Firepower Management Center 4000

For information on the syntax for building traffic profile conditions and host profile qualifications, see:

FireSIGHT

You can create simple traffic profile conditions and host profile qualifications, or you can create more 
elaborate constructs by combining and nesting conditions.

When your construct includes more than one condition, you must link them with an 

 or an 

 

operator. Conditions on the same level are evaluated together:

The 

 operator requires that all conditions on the level it controls must be met.

The 

 operator requires that at least one of the conditions on the level it controls must be met.

For example, the following traffic profile contains two conditions linked by 

. This means that the 

traffic profile collects connection data only if both conditions are true. In this example, it collects HTTP 
connections for all hosts with IP addresses in the 10.4.x.x subnet.

In contrast, the following traffic profile, which collects connection data for HTTP activity in either the 
10.4.x.x network or the 192.168.x.x network, has three conditions, with the last constituting a complex 
condition.