Cisco Cisco Firepower Management Center 4000

Type the name of a security zone associated with the packet that triggered the event. These fields 
are case-insensitive. See 

Specify the device where the access control policy was applied. You can specify a device name, 
device group, or IP address. See 

, and 

.

Note that the primary and secondary devices in a stacked configuration report intrusion events 
separately. See 

 for more information.

Type the name of the security context identifying the virtual firewall group through which the traffic 
passed. Note that the system only populates this field for ASA FirePOWER devices in multi-context 
mode.

Type the name of an interface associated with the packet that triggered the event; see 

.

Type the name of the intrusion policy associated with the event; see 

.

Type the name of the access control policy associated with the event; see 

Type the name of the access control policy associated with the event; see 

.

Specify a single host name that was extracted from the HTTP request Host header.

To associate host names with intrusion events for HTTP client traffic, you must enable the HTTP 
Inspect preprocessor 

 option. See 

 for more information.

Specify a single URI associated with the HTTP request packet that triggered the intrusion event.

To associate URIs with intrusion events for HTTP traffic, you must enable the HTTP Inspect 
preprocessor 

 option. See 

for more information.

Specify the address of the email sender that was extracted from the SMTP MAIL FROM command. 
You can also enter a comma-separated list to search for events associated with all specified 
addresses. See 

 for more information.