Cisco Cisco FirePOWER Appliance 7030
16-22
FireSIGHT System User Guide
Chapter 16 Working with Connection & Security Intelligence Data
Working with Connection Graphs
Drilling Down Through Connection Data Graphs
License:
Any
When you open a connection data workflow, the data is initially constrained only by a time range. You
can constrain connection graphs while advancing the workflow to the next page.
can constrain connection graphs while advancing the workflow to the next page.
To drill down in a connection data workflow:
Access:
Admin/Any Security Analyst
Step 1
Click a point on a line graph, a bar on a bar graph, or a wedge on a pie chart.
Step 2
Select
Drill-down
.
You drill down to the next workflow page, constraining using the item you clicked:
•
Clicking a point on a line graph constrains the time range on the next page to a 10-minute span,
centered on the point you clicked.
centered on the point you clicked.
•
Clicking a bar on a bar graph or a wedge on a pie chart constrains the next page based on the criterion
represented by the bar or wedge. For example, clicking on a bar that represents port use drills down
to the next page in the workflow, which is constrained by the port represented by the bar you clicked.
represented by the bar or wedge. For example, clicking on a bar that represents port use drills down
to the next page in the workflow, which is constrained by the port represented by the bar you clicked.
Recentering and Zooming on Line Graphs
License:
Any
You can recenter line graphs around any point in time. You can recenter using either the default time
range, or you can choose a different time range.
range, or you can choose a different time range.
Note
Unless you are working with a detached graph, recentering changes the default time range. For more
information on detached graphs, see
information on detached graphs, see
.
To recenter using the default time range:
Access:
Admin/Any Security Analyst
Step 1
Click the point on the line graph where you want to recenter the graph, and click
recenter
.
The graph is redrawn, centered on the point you clicked, with a time span that is the same length as your
default time range.
default time range.
To recenter using a different time range:
Access:
Admin/Any Security Analyst
Step 1
Click the point where you want to recenter the graph and click
Zoom
.
Step 2
Select the time span for the new graph, which can be as short as one hour or as long as one week.