Cisco Cisco Firepower Management Center 4000
44-10
FireSIGHT System User Guide
Chapter 44 Working with Reports
Using Report Templates
Host Report: $<Host>
The Host Report: $<Host> report template provides information about a specific host on the network.
This report template contains the following sections:
This report template contains the following sections:
•
Server Applications
•
Client Applications
•
Intrusion Events Originating from This Host
•
Intrusion Events Destined to This Host
•
Connections Originating from This Host
•
Connections Destined to This Host
•
Users of This Host
•
White List Violations by This Host
User Report: $<User>
The User Report: $<User> report template provides information about a specific user on the network.
This report template contains the following sections:
This report template contains the following sections:
•
Client Applications Used by This User
•
Web Applications Used by This User
•
Application Protocols Used by This User
•
Comprehensive List of Applications Used by This User
•
Intrusion Events Originated By This User’s Machines
•
Intrusion Events Destined to This User’s Machines
•
Connections Originating from This User’s Machines
•
Connections Destined to This User’s Machines
•
Hosts for This User
Attack Report: Attack $<Attack SID>
The Attack Report: Attack $<Attack SID> report template provides information about a specific attack
on the network. This report template contains the following sections:
on the network. This report template contains the following sections:
•
General Information About This Attack
•
Number of Attacks
•
Number of Machines Initiating Attack
•
Number of Machines Being Attacked
•
Sources of This Attack
•
Destinations of This Attack
•
Traffic Patterns of This Attack
Malware Report
The Malware Report report template provides information about network and endpoint-based malware
events. This report template contains the following sections:
events. This report template contains the following sections:
•
Malware Threats
•
Threat Detections over Time