Cisco Cisco Firepower Management Center 4000

The time window is unpaused and updates according to your preferences. The event view updates to 
reflect the current time window.

Any

The information that you see on a workflow page is determined by the constraints that you impose. For 
example, when you initially open an event workflow, the information is constrained to events that were 
generated in the previous hour.

To advance to the next page in the workflow and constrain the data you are viewing by specific values, 
select the rows with those values on the page and click 

. To advance to the next page in the workflow 

retaining the current constraints and carrying forward all events, select 

If you select a row with multiple non-count values and click 

, you create a compound constraint. For 

more information on compound constraints, see 

.

There is a third method for constraining data in a workflow. To constrain the page to the rows with values 
that you selected and also add the selected value to the list of constraints at the top of the page, click a 
value within a row on the page.

For example, if you click 

 in the Initiator IP column on a page with the following events: