Cisco Cisco Firepower Management Center 4000
27-34
FireSIGHT System User Guide
Chapter 27 Using the FireSIGHT System as a Compliance Tool
Working with White List Violations
white list, there is a separate row for each violated white list. The workflow also contains a table
view of white list violations that lists all violations with the most recently detected violation at the
top of the list. Each row in the table contains a single detected violation.
view of white list violations that lists all violations with the most recently detected violation at the
top of the list. Each row in the table contains a single detected violation.
•
The White List Violations workflow includes a table view of white list violations that lists all
violations with the most recently detected violation at the top of the list. Each row in the table
contains a single detected violation.
violations with the most recently detected violation at the top of the list. Each row in the table
contains a single detected violation.
Both predefined workflows terminate in a host view, which contains a host profile for every host that
meets your constraints. You can also create a custom workflow that displays only the information that
matches your specific needs. For more information, see
meets your constraints. You can also create a custom workflow that displays only the information that
matches your specific needs. For more information, see
The following table describes some of the specific actions you can perform on a white list violations
workflow page.
workflow page.
To view compliance white list violations:
Access:
Admin/Any Security Analyst/Discovery Admin
Step 1
Select
Analysis > Correlation > White List Violations
.
Table 27-6
Compliance White List Violations Actions
To...
You can...
view the host profile for a host
click the host profile icon (
) that appears next to the IP address.
sort and constrain events on the
current workflow page
current workflow page
find more information in
navigate within the current workflow
page
page
find more information in
navigate between pages in the current
workflow, keeping the current
constraints
workflow, keeping the current
constraints
click the appropriate page link at the top left of the workflow page. For more
information, see
information, see
learn more about the columns that
appear
appear
find more information in
.
drill down to the next page in the
workflow
workflow
use one of the following methods:
•
To drill down to the next workflow page constraining on a specific value, click a
value within a row. Note that this only works on drill-down pages. Clicking a
value within a row in a table view constrains the table view and does not drill
down to the next page.
value within a row. Note that this only works on drill-down pages. Clicking a
value within a row in a table view constrains the table view and does not drill
down to the next page.
•
To drill down to the next workflow page constraining on some events, select the
check boxes next to the events you want to view on the next workflow page, then
click
check boxes next to the events you want to view on the next workflow page, then
click
View
.
•
To drill down to the next workflow page keeping the current constraints, click
View All
.
Tip
Table views always include “Table View” in the page name.
For more information, see
.
navigate to other event views to view
associated events
associated events
find more information in