Cisco Cisco Firepower Management Center 4000

Admin/Any Security Analyst

Select 

.

The Search page appears.

You have two options:

To search for connection data, from the 

 drop-down list, select 

.

To search for Security Intelligence data, from the 

 drop-down list, select 

.

The page reloads with the appropriate constraints.

Optionally, if you want to save the search, enter a name for the search in the 

 field.

If you do not enter a name, one is created automatically when you save the search.

Enter your search criteria in the appropriate fields.

See 

 for information on the fields in the 

connection and Security Intelligence events tables.

If you want to save the search so that other users can access it, clear the 

 check box. 

Otherwise, leave the check box selected to save the search as private.

If you want to use the search as a data restriction for a custom user role, you must save it as a private 
search.

You have the following options:

Click 

 to start the search.

Your search results appear in your default malware events workflow, constrained by the current time 
range.

Click 

 if you are modifying an existing search and want to save your changes.

 or 

 

associated with the 
connection

You cannot use the connection/Security Intelligence events Search page 
to search for file, malware, and intrusion events associated with a 
connection. For information on viewing these associated events, see 

 and 

the 

 or 

 for a 

connection

The system performs a partial match, that is, you can search for all or part 
of the field contents without using asterisks.

the total 

 (in bytes) or 

transport 

 used in 

the connection

These columns do not appear in table views. To determine if there is a 
protocol or traffic constraint on a connection table view, expand the search 
constraints.

 in a NetFlow 

connection

Type a list of comma-separated TCP flags to view all connections that 
have at least one of those flags (instead of all). You can also select the 

 

check box to search for connections that have any of the flags you specify 
as their only TCP flag.