Cisco Cisco Firepower Management Center 4000
16-15
FireSIGHT System User Guide
Chapter 16 Working with Connection & Security Intelligence Data
Working with Connection Graphs
Because traffic profiles are based on connection data (see
), you can
view traffic profiles as line graphs. You can manipulate these graphs in the same way as you would any
other connection graph, with some restrictions.
other connection graph, with some restrictions.
You cannot create data graphs from Security Intelligence events, although their connection event
counterparts are viewable in graph form. For interactive graphic views of Security Intelligence data, you
can view the Security Intelligence section of the Context Explorer. See
counterparts are viewable in graph form. For interactive graphic views of Security Intelligence data, you
can view the Security Intelligence section of the Context Explorer. See
for more information.
Note
To view traffic profiles, you must have Administrator access. Compare this with other connection
graphs, which you can view with any Security Analyst or Administrator access.
graphs, which you can view with any Security Analyst or Administrator access.
When you view a connection graph, as described in
, you can perform the basic actions described in the following table.
Access:
Admin/Any Security Analyst
There are many other ways you can manipulate connection graphs as you perform in-depth analysis of
connection data. For more information, see:
connection data. For more information, see:
•
explains how to change between bar graphs and pie chart, and
between standard line graphs and velocity graphs.
•
explains how to display several values on the y-axis for each x-axis
data point on line graphs and bar graphs.
•
explains how to get more
information about the data points on a graph, or to display the host profile of a host whose statistics
are being graphed.
are being graphed.
•
explains how to constrain the
data that appears on a connection graph without advancing the workflow to the next page.
•
explains how to constrain the data that
appears on a connection graph while advancing the workflow to the next page.
Table 16-3
Basic Connection Graph Functions
To...
You can...
learn more about the data that appears
find more information in
modify the time and date range
find more information in
.
view a host’s profile
on a graph displaying connection data by initiator or
responder, click either a bar on a bar graph or a wedge on a
pie chart and select
responder, click either a bar on a bar graph or a wedge on a
pie chart and select
View Host Profile
.
use a different workflow, including a
custom workflow
custom workflow
click
(switch workflow)
by the workflow title.
navigate between pages in the current
workflow
workflow
find more information in
.
navigate to other event views to view
associated events
associated events
find more information in
.