Cisco Cisco Firepower Management Center 4000

FireSIGHT

The following table describes the predefined workflows that you can use with server data.

FireSIGHT

The following table describes the predefined workflow that you can use with host attribute data.

FireSIGHT

The following table describes the predefined workflow that you can use with discovery event data.

Network Applications by 
Count

You can use this workflow to analyze the most frequently used applications on your network. 
This workflow contains a series of pages that show applications with a count of hosts where each 
application occurs, then add the vendor and version of each application. The workflow then 
concludes with a table view listing the applications per host, followed by the host view. See 

 for more information.

Network Applications by 
Hit

You can use this workflow to analyze the most active applications on your network. This 
workflow contains a series of pages that show applications with a count of how often each 
application is accessed, then add the vendor and version information for each application. The 
workflow finishes with a page containing a table view listing the applications per host, followed 
by the host view. See 

 for more information.

Server Details

You can use this workflow to analyze the vendors and versions of detected server application 
protocols in detail. The workflow contains a list of servers associated with their vendors, then a 
list of servers correlated with both vendor and version, finishing with a table view of servers and 
the host view.

Servers

This workflow contains a table view of applications followed by the host view. See 

 for more information.

Attributes

You can use this workflow to monitor IP addresses of hosts on your network and the hosts’ 
status. This workflow begins with a table view of host attributes that lists individual IP addresses 
with current user, host criticality, notes, and white list compliance. It finishes with the host view. 
For more information, see 

.