Cisco Cisco Firepower Management Center 4000
47-42
FireSIGHT System User Guide
Chapter 47 Understanding and Using Workflows
Using Custom Workflows
•
To add a drill-down page that contains connection summary data, click
Add Summary Page
.
In either case, a drill-down page section appears.
Begin by typing a name for the page in the
Page Name
field using up to 80 alphanumeric characters, but
no spaces.
Under
Column 1
, select a sort priority and a table column. This column will appear in the leftmost column
of the page.
Continue selecting fields to include and setting their sort priority until all the fields to appear on the page
have been specified. You can specify up to five fields per page.
have been specified. You can specify up to five fields per page.
For example, to create a page showing the amount of traffic transmitted over your monitored network
and to sort the page by the responders that transmitted the most traffic, select
and to sort the page by the responders that transmitted the most traffic, select
1
from the
Sort Priority
drop-down list and
Responder Bytes
from the
Field
drop-down list.
Step 7
Optionally, click
Add Graph
to add one or more graph pages to the workflow.
A graph section appears.
Begin by typing a name for the page in the
Graph Name
field using up to 80 alphanumeric characters, but
no spaces.
Then, select the type of graph you want to include on the page: line graph, bar graph, or pie chart.
Then, specify what kind of data you want to graph by selecting the x- and y-axes of the graph. On a pie
chart, the x-axis represents the independent variable and the y-axis represents the dependent variable.
chart, the x-axis represents the independent variable and the y-axis represents the dependent variable.
Finally, select the datasets you want to include on the graph. Note that pie charts can only include one
data set.
data set.
Step 8
Optionally, add a table view of connection data by clicking
Add Table View
.
Step 9
Click
Save
.
The new workflow is saved and added to the list of custom workflows.
Viewing Custom Workflows
License:
Any
The method you use to view a workflow depends on whether the workflow is based on one of the
predefined event tables or on a custom table.
predefined event tables or on a custom table.
If your custom workflow is based on a predefined event table, access it in the same way that you would
access a workflow that ships with the appliance. For example, to access a custom workflow based on the
Hosts table, select
access a workflow that ships with the appliance. For example, to access a custom workflow based on the
Hosts table, select
Analysis Hosts
. If, on the other hand, your custom workflow is based on a custom table,
you must access it from the Custom Tables page.
Tip
You can set a custom workflow as the default workflow for any event type; see
.
For more information, see:
•
•