Cisco Cisco Firepower Management Center 4000

Page of 1844
 
44-10
FireSIGHT System User Guide
 
Chapter 44      Working with Reports 
  Using Report Templates
Host Report: $<Host>
The Host Report: $<Host> report template provides information about a specific host on the network. 
This report template contains the following sections:
  •
Server Applications
  •
Client Applications
  •
Intrusion Events Originating from This Host
  •
Intrusion Events Destined to This Host
  •
Connections Originating from This Host
  •
Connections Destined to This Host
  •
Users of This Host
  •
White List Violations by This Host
User Report: $<User>
The User Report: $<User> report template provides information about a specific user on the network. 
This report template contains the following sections:
  •
Client Applications Used by This User
  •
Web Applications Used by This User
  •
Application Protocols Used by This User
  •
Comprehensive List of Applications Used by This User
  •
Intrusion Events Originated By This User’s Machines
  •
Intrusion Events Destined to This User’s Machines
  •
Connections Originating from This User’s Machines
  •
Connections Destined to This User’s Machines
  •
Hosts for This User
Attack Report: Attack $<Attack SID>
The Attack Report: Attack $<Attack SID> report template provides information about a specific attack 
on the network. This report template contains the following sections:
  •
General Information About This Attack
  •
Number of Attacks
  •
Number of Machines Initiating Attack
  •
Number of Machines Being Attacked
  •
Sources of This Attack
  •
Destinations of This Attack
  •
Traffic Patterns of This Attack
Malware Report
The Malware Report report template provides information about network and endpoint-based malware 
events. This report template contains the following sections:
  •
Malware Threats
  •
Threat Detections over Time