Cisco Cisco FirePOWER Appliance 8250
47-31
FireSIGHT System User Guide
Chapter 47 Understanding and Using Workflows
Using Workflows
The time window is unpaused and updates according to your preferences. The event view updates to
reflect the current time window.
reflect the current time window.
Constraining Events
License:
Any
The information that you see on a workflow page is determined by the constraints that you impose. For
example, when you initially open an event workflow, the information is constrained to events that were
generated in the previous hour.
example, when you initially open an event workflow, the information is constrained to events that were
generated in the previous hour.
To advance to the next page in the workflow and constrain the data you are viewing by specific values,
select the rows with those values on the page and click
select the rows with those values on the page and click
View
. To advance to the next page in the workflow
retaining the current constraints and carrying forward all events, select
View All.
Note
If you select a row with multiple non-count values and click
View
, you create a compound constraint. For
more information on compound constraints, see
.
There is a third method for constraining data in a workflow. To constrain the page to the rows with values
that you selected and also add the selected value to the list of constraints at the top of the page, click a
value within a row on the page.
that you selected and also add the selected value to the list of constraints at the top of the page, click a
value within a row on the page.
For example, if you click
10.10.60.119
in the Initiator IP column on a page with the following events: