Cisco Cisco Firepower Management Center 4000
45-3
FireSIGHT System User Guide
Chapter 45 Searching for Events
Performing and Saving Searches
•
•
•
•
•
•
•
•
•
•
•
•
•
Step 6
If you want to save the search so that other users can access it, clear the
Save As Private
check box.
Otherwise, leave the check box selected to save the search as private.
Tip
If you want to use the search as a data restriction for a custom user role, you must save it as a private
search.
search.
Step 7
You have the following options:
•
Click
Search
to start the search.
Your search results appear in the default workflow for the table you are searching, constrained by
time (if applicable). To use a different workflow, including a custom workflow, click
time (if applicable). To use a different workflow, including a custom workflow, click
(switch
workflow)
by the workflow title. For information on specifying a different default workflow, see
. Note that you cannot use a different workflow for scan
results.
•
Click
Save
if you are modifying an existing search and want to save your changes.
•
Click
Save As New Search
to save the search criteria. The search is saved (and associated with your
user account if you selected
Save As Private
) so that you can run it at a later time.
Loading a Saved Search
License:
Any
If you previously saved a search, you can load it, make any necessary modifications, and then start the
search.
search.
To load a saved search:
Access:
Admin/Any Security Analyst
Step 1
You have two options: