Cisco Cisco FirePOWER Appliance 8250
47-11
FireSIGHT System User Guide
Chapter 47 Understanding and Using Workflows
Components of a Workflow
Predefined Servers Workflows
License:
FireSIGHT
The following table describes the predefined workflows that you can use with server data.
Predefined Host Attributes Workflows
License:
FireSIGHT
The following table describes the predefined workflow that you can use with host attribute data.
Predefined Discovery Events Workflows
License:
FireSIGHT
The following table describes the predefined workflow that you can use with discovery event data.
Table 47-11
Predefined Servers Workflows
Workflow Name
Description
Network Applications by
Count
Count
You can use this workflow to analyze the most frequently used applications on your network.
This workflow contains a series of pages that show applications with a count of hosts where each
application occurs, then add the vendor and version of each application. The workflow then
concludes with a table view listing the applications per host, followed by the host view. See
This workflow contains a series of pages that show applications with a count of hosts where each
application occurs, then add the vendor and version of each application. The workflow then
concludes with a table view listing the applications per host, followed by the host view. See
for more information.
Network Applications by
Hit
Hit
You can use this workflow to analyze the most active applications on your network. This
workflow contains a series of pages that show applications with a count of how often each
application is accessed, then add the vendor and version information for each application. The
workflow finishes with a page containing a table view listing the applications per host, followed
by the host view. See
workflow contains a series of pages that show applications with a count of how often each
application is accessed, then add the vendor and version information for each application. The
workflow finishes with a page containing a table view listing the applications per host, followed
by the host view. See
for more information.
Server Details
You can use this workflow to analyze the vendors and versions of detected server application
protocols in detail. The workflow contains a list of servers associated with their vendors, then a
list of servers correlated with both vendor and version, finishing with a table view of servers and
the host view.
protocols in detail. The workflow contains a list of servers associated with their vendors, then a
list of servers correlated with both vendor and version, finishing with a table view of servers and
the host view.
Servers
This workflow contains a table view of applications followed by the host view. See
for more information.
Table 47-12
Predefined Host Attributes Workflows
Workflow Name
Description
Attributes
You can use this workflow to monitor IP addresses of hosts on your network and the hosts’
status. This workflow begins with a table view of host attributes that lists individual IP addresses
with current user, host criticality, notes, and white list compliance. It finishes with the host view.
For more information, see
status. This workflow begins with a table view of host attributes that lists individual IP addresses
with current user, host criticality, notes, and white list compliance. It finishes with the host view.
For more information, see
.