Cisco Cisco FirePOWER Appliance 7030
37-13
FireSIGHT System User Guide
Chapter 37 Using Host Profiles
Working with Operating Systems in the Host Profile
Resolving Operating System Identity Conflicts
License:
FireSIGHT
An operating system identity conflict occurs when a new identity detected by the system conflicts with
the current identity, if that identity was provided by an active source, such as a scanner, application, or
user.
the current identity, if that identity was provided by an active source, such as a scanner, application, or
user.
The list of operating system identities in conflict displays in bold in the host profile.
You can resolve an identity conflict and set the current operating system identity for a host through the
system web interface. Setting the identity through the web interface overrides all other identity sources
so that identity is used for vulnerability assessment and impact correlation.
system web interface. Setting the identity through the web interface overrides all other identity sources
so that identity is used for vulnerability assessment and impact correlation.
To make one of the conflicting identities current:
Access:
Admin/Any Security Analyst
Step 1
You have two options:
•
Click
Make Current
next to the operating system identity you want to set as the operating system for
the host.
•
If the identity that you do not want as the current identity came from an active source, delete the
unwanted identity.
unwanted identity.
To resolve an operating system identity conflict:
Access:
Admin/Any Security Analyst
Step 1
In a host profile, click
Resolve
in the
Operating System Conflicts
section.
A pop-up window appears where you can set the current operating system identity.
Step 2
You have several options:
•
Select
Current Definition
from the
OS Definition
drop-down list to confirm the current operating system
identity through host input, then skip to step
.
•
Select a variation on one of the conflicting operating system identities from the
OS Definition
drop-down list, then skip to step
•
Select
User-Defined
from the
OS Definition
drop-down list, then continue with step
Step 3
Optionally, select
Use Custom Display String
and type the custom strings you want to display in the
Vendor
String
,
Product String
, and
Version String
fields.
Step 4
Optionally, to change to an operating system from a different vendor, select the vendor and other
operating system details.
operating system details.
Step 5
Optionally, to configure the operating system product release level, select the applicable items in the
Major
,
Minor
,
Revision
,
Build, Patch,
and
Extension
drop-down lists.
Step 6
Optionally, if you want to indicate that fixes for the operating system have been applied, click
Configure
Fixes
.
Step 7
Add the fixes you have applied to the fixes list.
Step 8
Click
Finish
to complete the operating system identity configuration and return to the host profile.