Cisco Cisco Firepower Management Center 4000

Page of 1844
 
47-30
FireSIGHT System User Guide
 
Chapter 47      Understanding and Using Workflows 
  Using Workflows
To change time window preferences during event analysis:
Access: 
Admin/Maint/Any Security Analyst
Step 1
On a workflow constrained by time, click the time range icon (
).
The Date/Time window appears.
Step 2
Select the 
Preferences
 tab and change your preferences, as described in the 
 
table.
Step 3
Click 
Save Preferences
.
Your preferences are saved.
Step 4
You have two options:
  •
To apply your new default time window settings to the event view you are using, click 
Apply
 to close 
the Date/Time window and refresh the event view.
  •
To continue with your analysis without applying the default time window settings, close the 
Date/Time window without clicking 
Apply
.
Pausing the Time Window
License: 
Any
You can pause the time window, which allows you to examine a snapshot of the data provided by the 
workflow. This is useful because when an unpaused workflow updates, it may remove events that you 
want to examine or add events that you are not interested in. 
Note that you cannot pause a static time window. In addition, pausing an event time window has no effect 
on dashboards, nor does pausing a dashboard have any effect on pausing an event time window.
When you are finished with your analysis, you can unpause the time window. Unpausing the time 
window updates it according to your preferences, and also updates the event view to reflect the unpaused 
time window.
If the database contains more events than can be displayed on a single workflow page, you can click the 
links at the bottom of the page to display more events (see 
). When you do this, the time window automatically pauses so that you do not see the same 
events twice. You can unpause the time window when you are ready.
To pause the time window:
Access: 
Admin/Maint/Any Security Analyst
Step 1
On the time range control, click the pause icon (
).
The time window is paused until you unpause it.
To unpause the time window:
Access: 
Admin/Maint/Any Security Analyst
Step 1
On the time range control, click the play icon (
).