Cisco Cisco Firepower Management Center 4000
42-29
FireSIGHT System User Guide
Chapter 42 Enhancing Network Discovery
Importing Host Input Data
Note
The system only uses applications with active detectors to analyze application traffic. For more
information, see
information, see
Deleting Detectors
License:
FireSIGHT
Use the following procedure to delete a detector. You can delete user-defined detectors as well as
individually imported add-on detectors provided by Cisco Professional Services. You cannot delete any
of the other Cisco-provided detectors, though you can deactivate many of them.
individually imported add-on detectors provided by Cisco Professional Services. You cannot delete any
of the other Cisco-provided detectors, though you can deactivate many of them.
Note
While a detector is in use in an applied policy, you cannot deactivate or delete the detector.
To delete a detector:
Access:
Admin/Discovery Admin
Step 1
Select
Policies
> Application Detectors
.
The Detectors page appears.
Step 2
Select the check box next to the detector you want to delete and click
Delete
.
If the detector you want to delete is not on the first page, you can find it by paging through the detector
list or applying one or more filters. For more information, see
list or applying one or more filters. For more information, see
.
Step 3
Click
OK
to confirm that you want to delete the detector.
The detector is deleted.
Importing Host Input Data
License:
FireSIGHT
If your organization has the capability to write scripts or create command line import files to import
network map data from third parties, you can import data to augment the information in the network map.
You can also use the host input feature by modifying operating system or application identities or
deleting application protocols, protocols, host attributes, or clients using the web interface.
network map data from third parties, you can import data to augment the information in the network map.
You can also use the host input feature by modifying operating system or application identities or
deleting application protocols, protocols, host attributes, or clients using the web interface.
The system may reconcile data from multiple sources to determine the current identity of an operating
system or application. For more information on how the system does this, see
system or application. For more information on how the system does this, see
.
Note that all data except third-party vulnerabilities is discarded when the affected host is removed from
the network map. For more information on setting up scripts or import files, see the FireSIGHT System
Host Input API Guide.
the network map. For more information on setting up scripts or import files, see the FireSIGHT System
Host Input API Guide.
To include imported data in impact correlations, you must map the data to the operating system and
application definitions in the database. For more information, see the following sections:
application definitions in the database. For more information, see the following sections:
•