Cisco Cisco Firepower Management Center 4000

Optionally, you can further constrain the widget using a saved search, either one of the predefined 
searches delivered with your appliance or a custom search that you created. For example, constraining 
the first example (intrusion events using the 

 field, aggregated by 

) using the 

search tells you how many intrusion events of each type were dropped. 

The colored bars in the widget background show the relative number of occurrences of each event; you 
should read the bars from right to left. You can change the color of the bars as well as the number of rows 
that the widget displays. You can also configure the widget to display the most frequently occurring 
events or the least frequently occurring events.

The direction icon (

) indicates and controls the sort order of the display. A downward-pointing icon 

indicates descending order; an upward-pointing icon indicates ascending order. To change the sort order, 
click the icon.

Next to each event, the widget can display one of three icons to indicate any changes from the most 
recent results:

The new event icon (

) signifies that the event is new to the results.

The up arrow icon (

) indicates that the event has moved up in the standings since the last time 

the widget updated. A number indicating how many places the event has moved up appears next to 
the icon.