Cisco Cisco Firepower Management Center 4000
50-14
FireSIGHT System User Guide
Chapter 50 Managing System Policies
Configuring a System Policy
Step 2
You have the following options:
•
To modify the dashboard settings in an existing system policy, click the edit icon (
)
next to the
system policy.
•
To configure the dashboard settings as part of a new system policy, click
Create Policy
. Provide a
click
Save.
In either case, the Access List page appears.
Step 3
Click
Dashboard.
The
Dashboard Settings page appears.
Step 4
Select the
Enable Custom Analysis Widgets
check box to allow users to add Custom Analysis widgets to
dashboards. Clear the check box to prohibit users from using those widgets.
Step 5
Click
Save Policy and Exit.
The system policy is updated. Your changes do not take effect until you apply the system policy. See
Configuring Database Event Limits
License:
Any
Use the Database page to specify the maximum number of each type of event that the Defense Center
can store. Note that the setting for audit records also applies to managed devices. To improve
performance, you should tailor event limits to the number of events you regularly work with. For some
event types, you can disable storage. The following table lists the minimum and maximum number of
records you can store for each event type.
can store. Note that the setting for audit records also applies to managed devices. To improve
performance, you should tailor event limits to the number of events you regularly work with. For some
event types, you can disable storage. The following table lists the minimum and maximum number of
records you can store for each event type.
Table 50-2
Database Event Limits
Event Type
Upper Event Limit
Lower Event Limit
intrusion events
2.5 million (DC500)
10 million (DC1000, virtual Defense Center)
20 million (DC750)
30 million (DC1500)
100 million (DC3000)
150 million (DC3500)
10,000
discovery events
10 million
zero (disables storage)
connection events/Security
Intelligence Events
Intelligence Events
10 million (DC500, DC1000, virtual Defense Center)
50 million (DC750)
100 million (DC1500, DC3000)
500 million (DC3500)
Upper event limit is shared between connection events and
Security Intelligence events; the sum of configured maximums
for the two events cannot exceed the upper event limit.
Security Intelligence events; the sum of configured maximums
for the two events cannot exceed the upper event limit.
zero (disables storage)