Cisco Cisco Firepower Management Center 4000

Specify the address of the email recipient that was extracted from the SMTP RCPT TO command. 
You can also enter a comma-separated list to search for events associated with all specified 
addresses. See 

 for more information.

Specify the MIME attachment file name that was extracted from the MIME Content-Disposition 
header. Enter a comma-separated list to search for events associated with all attachment file names 
in the list. See 

 for more information.

Specify data that was extracted from the email header. Note that email headers do not appear in the 
table view of intrusion events, but you can use email header data as a search criterion.

To associate email headers with intrusion events for SMTP traffic, you must enable the SMTP 
preprocessor 

 option. See 

 for more 

information.

Specify the name of the user who reviewed the event. See 

.

You can enter 

unreviewed

 to search for events that have not been reviewed.

Admin/Intrusion Admin

Select 

.

The Intrusion Events search page appears.

You can also click 

 while viewing lists of intrusion events (

).

Optionally, if you want to save the search, enter a name for the search in the 

 field.

If you do not enter a name, one is automatically created when you save the search.

Enter your search criteria in the appropriate fields, as described in the list above the procedure.

For more information on search syntax, including using objects in searches, see 

.

If you want to save the search so that other users can access it, clear the 

 check box. 

Otherwise, leave the check box selected to save the search as private. Note that users with the 
Administrator role can still view searches that you save as private.

If you want to use the search as a data restriction for a custom user role, you must save it as a private 
search.

You have the following options:

Click 

 to start the search.

Your search results appear in the default intrusion events workflow, constrained by the current time 
range. For information on specifying a different default workflow, see 

.

Click 

 if you are modifying an existing search and want to save your changes.