Cisco Cisco Firepower Management Center 4000
46-4
FireSIGHT System User Guide
Chapter 46 Using Custom Tables
Understanding Custom Tables
Sometimes a field in one table maps to more than one field in another table. For example, the predefined
Intrusion Events with Destination Criticality
custom table combines fields from the Intrusion Events table and
the Hosts table. Each event in the Intrusion Events table has two IP addresses associated with it—a
source IP address and a destination IP address. However, the “events” in the Hosts table each represent
a single host IP address (hosts may have multiple IP addresses). Therefore, when you create a custom
source IP address and a destination IP address. However, the “events” in the Hosts table each represent
a single host IP address (hosts may have multiple IP addresses). Therefore, when you create a custom
Discovery Events
•
Applications
•
Host Attributes
•
Hosts
Connection Events
•
Applications
•
Host Attributes
•
Hosts
•
Servers
Security Intelligence Events
•
Applications
•
Host Attributes
•
Hosts
•
Servers
Hosts
•
Applications
•
Correlation Events
•
Intrusion Events
•
Connection Summary Data
•
Host Attributes
•
Application Details
•
Discovery Events
•
Connection Events
•
Servers
•
White List Events
Servers
•
Applications
•
Intrusion Events
•
Connection Summary Data
•
Host Attributes
•
Connection Events
•
Hosts
White List Events
•
Applications
•
Host Attributes
•
Hosts
Table 46-2
Custom Table Combinations (continued)
You can combine fields from...
With fields from...