Cisco Cisco Firepower Management Center 4000

The number of intrusion events that appear on the event views may be quite large, depending on:

the time range you select

the amount of traffic on your network

the intrusion policy you apply

To make it easier to analyze intrusion events, you can constrain the event pages. The constraining 
processes are slightly different for drill-down views and the table view of intrusion events. 

The time range pauses when you click one of the links at the bottom of the intrusion event workflow 
page to navigate to another page, and resumes when you click to take any other action on the subsequent 
page, including exiting the workflow; this reduces the likelihood of displaying the same events as you 
navigate to other pages in the workflow to see more events. For more information, see 

 and 

The following table describes how to use the drill-down pages.

mark events reviewed to remove 
them from intrusion event pages, but 
not the event database

use one of the following methods:

To review selected intrusion events, select the check boxes next to events you want 
to review, then click 

.

To review all the intrusion events in the current constrained view, click 

.

For more information, see 

download a local copy of the packet 
(a packet capture file in libpcap 
format) that triggered each selected 
event

use one of the following methods:

To download the packets that triggered the selected intrusion events, select the 
check boxes next to events triggered by the packets you want to download, then 
click 

.

To download all packets that triggered the intrusion events in the current 
constrained view, click 

.

Captured packets are saved in libpcap format. This format is used by several popular 
protocol analyzers.

navigate to other event views to view 
associated events

find more information in 

temporarily use a different workflow click 

. For more information, see 

.

bookmark the current page so that 
you can quickly return to it

click 

. For more information, see 

view the Intrusion Events section of 
the Summary Dashboard

click 

. For more information, see 

.

navigate to the bookmark 
management page

click 

. For more information, see 

.

generate a report based on the data in 
the current view

click 

. For more information, see 

.