Cisco Cisco Firepower Management Center 4000

Any

Before you generate a report, the reporting system creates a report template that you can modify to meet 
your needs. You can add additional sections, modify automatically included sections, and delete 
sections.

Admin/Any Security Analyst

Populate an event view with the events you want in the report. You can do this in various ways:

Use an event search to define the events you want to view. For details on using the event search, see 

.

Drill down through a workflow until you have the appropriate events in your event view. For details 
on workflows and how to constrain events within a workflow, see 

From the event view page, click 

.

The Report Sections page appears with a section for each view in the captured workflow. 

Optionally, type a new name in the 

 field and click 

.

Optionally, delete any template sections that you want to exclude from the report by clicking the delete 
icon (

) in the section’s title bar, and confirm the deletion.

The deleted sections disappear.

The last report section in some workflows contains detail views that show packets, host profiles, 
or vulnerabilities, depending on the workflow. Retrieving large numbers of events with these 
detail views when generating your report may affect performance of the Defense Center.

Optionally, adjust the settings of the fields in your report sections.

For details on configuring the fields in a report section, see 

To view the current column layout or chart formatting for a section, click the section’s 

 link.

Optionally, change the title of any section by clicking the section title in the title bar.

The Set Section Title pop-up window appears. Type the section title and click 

.

Optionally, add page breaks. Click the add page break icon (

).

A new page break object appears at the bottom of the template. Drag it in front of the section that should 
start the new page. For information on using page breaks, see