Cisco Cisco Firepower Management Center 4000

From the 

 drop-down list, select the application protocol type. For custom application protocols, 

select 

.

Specify the application protocol port. You have two options:

To allow the application protocol to run on any port, check the 

 check box.

To allow the application protocol to run only on a specific port, type the port number in the 

 field.

From the 

 drop-down list, select the protocol: 

 or 

.

Optionally, in the 

 and 

 fields, specify a vendor and version for the application protocol.

If you do not specify a vendor or version, the white list allows all vendors and versions as long as the 
type and protocol match. Note that if you restrict the vendor and version, you must make sure to specify 
them exactly as they would appear in an event view or in the application protocols network map.

Click 

.

The application protocol is added. Note that you must save the white list for your changes to take effect.

If you added an application protocol to a white list that is used by an active correlation policy, after you 
save the white list, the target hosts are re-evaluated. Although this re-evaluation may bring some hosts 
into compliance, it does not generate any white list events.

FireSIGHT

You can configure a compliance white list, using either a shared host profile or a host profile that belongs 
to a single white list, to allow certain client applications to run on specific operating systems. You can 
also configure a white list to allow certain clients to run on any valid target; these are called globally 
allowed clients.

Optionally, you can require that the client be a specific version. For example, you could allow only 
Microsoft Internet Explorer 8.0 to run on Microsoft Windows hosts.

Admin 

While you are creating or modifying a white list host profile, click the add icon (

) next to 

 (or next to 

 if you are modifying the Any Operating System host profile).

A pop-up window appears. The clients listed are:

clients that you created within the white list 

clients that were running on hosts in the network map when you surveyed your networks as 
described in 

clients that are used by other host profiles in the white list, which may include built-in clients created 
by the VRT for use in the default white list

You have two options:

To add a client already in the list, select it and click 

. Use Ctrl or Shift while clicking to select 

multiple clients. You can also click and drag to select multiple adjacent clients.