Cisco Cisco Firepower Management Center 4000
46-10
FireSIGHT System User Guide
Chapter 46 Using Custom Tables
Searching Custom Tables
To implement these criteria in a table search, see the following procedure.
To perform a search on a custom table:
Access:
Any/Admin
Step 1
Select
Analysis > Custom > Custom Tables
.
The Custom Tables page appears.
Step 2
Click the view icon (
) next to the custom table you want to search.
The first page of the default workflow for the custom table appears. To use a different workflow,
including a custom workflow, click
including a custom workflow, click
(switch workflow)
by the workflow title. For information on specifying
a different default workflow, see
. If no events appear and
the workflow can be constrained by time, you may need to adjust the time range; see
.
Step 3
Click
Search
.
The custom table’s search page appears.
Tip
To search the database for a different kind of event or data, select it from the
Table
drop-down list.
Step 4
Optionally, if you want to save the search, enter a name for it in the
Name
field.
If you do not enter a name, one is created automatically when you save the search.
Step 5
Enter your search criteria in the appropriate fields. For more information about choosing search criteria,
see the
see the
table.
If you enter multiple criteria, the search returns only the records that match all criteria.
Tip
Click the object icon (
) next to a search field to use an object as a search criterion. For more
information on searches, including information on special search syntax, using objects in searches, and
saving and loading searches, see
saving and loading searches, see
Step 6
If you want to save the search so that other users can access it, clear the
Save As Private
check box.
Otherwise, leave the check box selected to save the search as private.
Rule Update Import Log
Applications
Security Intelligence Events
Users
Vulnerabilities
White List Events
White List Violations
Table 46-3
Table Search Criteria (continued)
For search criteria for...
See...