Cisco Cisco Firepower Management Center 4000

The graph is redrawn, centered on the point you clicked, with the time span you selected.

Any

You can display different data on a connection graph by changing either the x-axis, the y-axis, or both.

Note that on a pie chart, changing the x-axis changes the independent variable and changing the y-axis 
changes the dependent variable. For example, consider a pie chart that graphs kilobytes per port. In this 
case, the x-axis is 

 and the y-axis is 

. This pie chart represents the total kilobytes of 

data transmitted over a monitored network during a certain interval. The wedges of the pie represent the 
percent of the data that was detected on each port. If you change the x-axis of the chart to 

, the pie chart still represents the total kilobytes of data transmitted, but the wedges of the pie 

represent the percentage of the data transmitted for each detected application protocol.

However, if you change the y-axis of the first pie chart to 

, the pie chart represents the total 

number of packets transmitted over the monitored network during a certain interval, and the wedges of 
the pie represent the percentage of the total number of packets that was detected on each port.

Follow the directions in the following table to change the x-axis of a connection graph.

Follow the directions in the following table to change the y-axis of a connection graph.

by the 10 most active application protocols on the monitored network 
based on the number of detected connection events

click 

 and select 

.

by the 10 most active managed devices on the monitored network 
based on the number of detected connection events

click 

 and select 

.

by the 10 most active host IP addresses on the monitored network 
based on the number of connection events where that host IP address 
initiated the connection transaction

click 

 and select 

.

by the 10 most active users on the monitored network based on the 
number of connection events where the host where the user is logged 
in initiated the connection transaction

click 

 and select 

.

by the 10 most active host IP addresses on the monitored network 
based on the number of connection events where that address was the 
responder in the connection transaction

click 

 and select 

.

by the 10 most active ports on the monitored network based on the 
number of detected connection events where the host was the 
responder in the connection transaction

click 

 and select 

.

by the 10 most active source devices, which include 
NetFlow-enabled devices that exported the connection data for the 
connections, plus a source device named FireSIGHT for all 
connections detected by Cisco managed devices

click 

 and select 

.

over time

click 

 and select 

.