Cisco Cisco Firepower Management Center 4000

Select 

. 

The Instances page appears.

Select 

 from the 

drop-down list and click 

.

The Edit Instance page appears.

In the 

 field, enter a name that includes 1 to 63 alphanumeric characters, with no spaces 

and no special characters other than underscore (_) and dash (-). 

In the 

 field, specify a description that includes 0 to 255 alphanumeric characters, including 

spaces and special characters.

Click 

.

The instance is created. 

FireSIGHT

You can create a set attribute value remediation for each attribute value you want to be able to set in 
response to a correlation rule violation. If the attribute you want to set is a text attribute, you can set the 
remediation to use the description from the event as the attribute value. 

Admin/Discovery Admin

Select 

. 

The Instances page appears.

Click 

 next to the scan instance where you want to add a remediation.

The Edit Instance page appears.

Select 

from the 

 drop-down list.

The Edit Remediation page appears.

In the 

 field, type a name for the remediation that includes 1 to 63 alphanumeric 

characters, with no spaces and no special characters other than underscore (_) and dash (-).

In the 

 field, type a description for the remediation that includes 0 to 255 alphanumeric 

characters, including spaces and special characters.

If you plan to use this remediation in response to a correlation rule that triggers on an intrusion event, 
user event, or a connection event, configure the 

 option.

Select 

 to update the attribute value on the hosts represented by the 

source IP address and the destination IP address in the event.

Select 

 to update the attribute value on the host represented by the event’s 

source IP address.

Select 

 to update the attribute value on the host represented by the event’s 

destination IP address.