Cisco Cisco Firepower Management Center 4000

Cisco

Contents

xxi

FireSIGHT System User Guide

Searching for Malware Events

34-21

Working with Captured Files

34-23

Viewing Captured Files

34-24

Understanding the Captured Files Table

34-25

Searching for Captured Files

34-26

Working with Network File Trajectory

34-28

Reviewing Network File Trajectory

34-28

Analyzing Network File Trajectory

34-30

C H A P T E R

Introduction to Network Discovery

35-1

Understanding Discovery Data Collection

35-1

Understanding Host Data Collection

35-2

Understanding User Data Collection

35-3

Understanding Application Detection

35-10

Importing Third-Party Discovery Data

35-15

Uses for Discovery Data

35-16

Understanding NetFlow

35-16

Differences Between NetFlow and FireSIGHT Data

35-17

Preparing to Analyze NetFlow Data

35-19

Understanding Indications of Compromise

35-20

Understanding Indications of Compromise Types

35-20

Viewing and Editing Indications of Compromise Data

35-22

Creating a Network Discovery Policy

35-22

Working with Discovery Rules

35-23

Restricting User Logging

35-30

Configuring Advanced Network Discovery Options

35-31

Applying the Network Discovery Policy

35-38

Obtaining User Data from LDAP Servers

35-39

Creating LDAP Connections with the Defense Center

35-39

Enabling and Disabling User Awareness LDAP Connections

35-44

Performing an On-Demand User Data Retrieval for Access Control

35-45

Configuring Defense Center-User Agent Connections

35-45

C H A P T E R

Using the Network Map

36-1

Understanding the Network Map

36-1

Working with the Hosts Network Map

36-2

Working with the Network Devices Network Map

36-3

Working with the Indications of Compromise Network Map

36-4