Cisco Cisco Firepower Management Center 4000

Connection graphs are based on aggregated data over five-minute intervals, also called connection 
summaries. You can get more information about the specific connection summaries used to construct a 
connection graph. For example, on a graph of connections over time, you may want to know exactly how 
many connections were detected over a specific interval.

Admin/Any Security Analyst

Position your cursor over a point on a line graph a bar in a bar graph, or a wedge in a pie chart. A tooltip 
appears with detailed information about the data used to construct that portion of the graph.

Any

When you open a connection data workflow, the data is initially constrained only by a time range. You 
can constrain connection graphs with additional criteria without advancing the workflow to the next 
page. 

Constraining connection data in this manner changes the x-axis (also called the independent variable 
when viewing a pie chart) of the graph. To change the independent variable without constraining the 
connection data, use the 

 and 

 menus. For more information, see 

Admin/Any Security Analyst

Click a point on a line graph, a bar on a bar graph, or a wedge on a pie chart.

Select a 

 option.

You can constrain connection data based on any of the criteria listed in the 

 table.

For example, consider a graph of connections over time. If you constrain a point on the graph by port, a 
bar graph appears, showing the 10 most active ports based on the number of detected connection events, 
but constrained by the ten-minute time span that is centered on the point you clicked.

If you further constrain the graph by clicking on one of the bars and selecting 

, a new 

bar graph appears, constrained by not only the same ten-minute time span as before, but also by the port 
represented by the bar you clicked.

Unless you are working with a detached graph, constraining connection data in this manner 
changes the time range. For more information on detached graphs, see