Cisco Cisco Firepower Management Center 4000
42-26
FireSIGHT System User Guide
Chapter 42 Enhancing Network Discovery
Working with Application Detectors
Type
Finds detectors according to the detector type:
Application Protocol
,
Web Application
,
Client
, or
Internal
Detector
.
Application protocol detectors have three subtypes you can use to further filter detectors:
– Port
application protocol detectors include the Cisco-provided well-known port detectors, as
well as any port-based user-defined application detectors.
– Pattern
application protocol detectors include pattern-based or port-and-pattern-based
user-defined application detectors.
–
FireSIGHT application protocol detectors are application protocol fingerprint detectors provided
by Cisco that can be activated and deactivated.
by Cisco that can be activated and deactivated.
For more information on detector types, see
.
Protocol
Finds detectors according to which traffic protocol the detector inspects. Detectors can inspect TCP,
UDP, or TCP and UDP traffic.
UDP, or TCP and UDP traffic.
Category
Finds detectors according to the categories assigned to the application they detect.
Tag
Finds detectors according to the tags assigned to the application they detect.
Risk
Finds detectors according to the risks assigned to the application they detect:
Very High
,
High
,
Medium
,
Low
, and
Very Low
.
Business Relevance
Finds detectors according to the business relevance assigned to the application they detect:
Very High
,
High
,
Medium
,
Low
, and
Very Low
.
To apply a filter:
Admin/Discovery Admin
Step 1
On the Detectors page, expand the filter group you want to use to filter the detectors.
Step 2
Type the name or select the specific filter you want to use. To select all filters in a group, right-click the
group name and select
group name and select
Check All
.
Step 3
Optionally, if the filter you are using has subfilters, select the subfilter to further filter the detectors.
To remove a filter:
Access:
Admin/Discovery Admin
Step 1
Click the remove icon (
) in the name of the filter in the
Filters
field or disable the filter in the filter
list. To remove all filters in a group, right-click the group name and select
Uncheck All
.
The filter is removed and the results update.