Cisco Cisco Firepower Management Center 4000

The ingress interface of the packet that triggered the event. Only this interface column is populated 
for a passive interface. See 

For an inline set, the egress interface of the packet that triggered the event. See 

The host IP address or domain name where the packet that triggered the event (source) originated, 
or the target (destination) host of the traffic that triggered the event. 

Note that to display the domain name, you must enable IP address resolution; for more information, 
see 

Click the address or domain name to view the context menu, then select 

 to do a whois search 

on the host, 

 to view host information, or 

 or 

 to add the 

address to a global blacklist or whitelist. See 

 and 

Source port of the packet that triggered the event. For ICMP traffic, where there is no port number, 
the system displays the ICMP type.

The port number for the host receiving the traffic. For ICMP traffic, where there is no port number, 
the system displays the ICMP code.

The data that was extracted from the email header. Note that email headers do not appear in the table 
view of intrusion events, but you can use email header data as a search criterion. 

To associate email headers with intrusion events for SMTP traffic, you must enable the SMTP 
preprocessor 

 option. See 

 for more 

information. For rule-based events, this row appears when email data is extracted.

The host name, if present, extracted from the HTTP request Host header. This row displays the 
complete host name, up to 256 bytes. Click the expand arrow (

) to display the complete host 

name when longer than a single row.

To display host names, you must enable the HTTP Inspect preprocessor 

 option. See 

 for more information.

Note that HTTP request packets do not always include a host name. For rule-based events, this row 
appears when the packet contains the HTTP host name or the HTTP URI.

The raw URI, if present, associated with the HTTP request packet that triggered the intrusion event. 
This row displays the complete URI, up to 2048 bytes. Click the expand arrow (

) to display the 

complete URI when it is longer than a single row.

To display the URI, you must enable the HTTP Inspect preprocessor 

 option. See 

 for more information.