Cisco Cisco Firepower Management Center 4000

Page of 1844
 
27-34
FireSIGHT System User Guide
 
Chapter 27      Using the FireSIGHT System as a Compliance Tool 
  Working with White List Violations
white list, there is a separate row for each violated white list. The workflow also contains a table 
view of white list violations that lists all violations with the most recently detected violation at the 
top of the list. Each row in the table contains a single detected violation. 
  •
The White List Violations workflow includes a table view of white list violations that lists all 
violations with the most recently detected violation at the top of the list. Each row in the table 
contains a single detected violation.
Both predefined workflows terminate in a host view, which contains a host profile for every host that 
meets your constraints. You can also create a custom workflow that displays only the information that 
matches your specific needs. For more information, see 
The following table describes some of the specific actions you can perform on a white list violations 
workflow page. 
To view compliance white list violations:
Access: 
Admin/Any Security Analyst/Discovery Admin
Step 1
Select 
Analysis > Correlation > White List Violations
.
Table 27-6
Compliance White List Violations Actions 
To...
You can...
view the host profile for a host
click the host profile icon (
) that appears next to the IP address.
sort and constrain events on the 
current workflow page
find more information in 
navigate within the current workflow 
page
find more information in 
navigate between pages in the current 
workflow, keeping the current 
constraints
click the appropriate page link at the top left of the workflow page. For more 
information, see 
learn more about the columns that 
appear
find more information in 
.
drill down to the next page in the 
workflow
use one of the following methods:
  •
To drill down to the next workflow page constraining on a specific value, click 
value within a row. Note that this only works on drill-down pages. Clicking a 
value within a row in a table view constrains the table view and does not drill 
down to the next page.
  •
To drill down to the next workflow page constraining on some events, select the 
check boxes next to the events you want to view on the next workflow page, then 
click 
View
.
  •
To drill down to the next workflow page keeping the current constraints, click 
View All
.
Tip
Table views always include “Table View” in the page name.
For more information, see 
.
navigate to other event views to view 
associated events
find more information in