Cisco Cisco FirePOWER Appliance 7020
37-17
FireSIGHT System User Guide
Chapter 37 Using Host Profiles
Working with Servers in the Host Profile
–
FireSIGHT
,
FireSIGHT
Port Match
, or
FireSIGHT Pattern Match
, for Cisco-detected
applications
–
NetFlow
, for servers added to the network map based on NetFlow data
The system may reconcile data from multiple sources to determine the identity of a server; see
.
To view the server detail for a server:
Access:
Admin/Any Security Analyst
Step 1
Click the view icon (
) next to a server in the
Servers
section of a host profile.
The Server Detail pop-up window appears.
Editing Server Identities
License:
FireSIGHT
You can manually update the identity settings for a server on a host and configure any fixes that you have
applied to the host to remove the vulnerabilities addressed by the fixes. You can also delete server
identities.
applied to the host to remove the vulnerabilities addressed by the fixes. You can also delete server
identities.
Note that deleting an identity does not delete the server, even if that is the only identity. Deleting an
identity does remove the identity from the Server Detail pop-up window and, if applicable, updates the
current identity for the server in the host profile.
identity does remove the identity from the Server Detail pop-up window and, if applicable, updates the
current identity for the server in the host profile.
You cannot edit or delete server identities added by a Cisco-managed device.
To edit the server identity:
Access:
Admin/Any Security Analyst
Step 1
In the
Servers
section in a host profile, click
View
to open the Server Detail pop-up window.
Step 2
You have two options:
•
To delete a server identity, click the delete icon (
) next to the server identity you want to remove.
•
To modify a server identity, click the edit icon (
) next to the server in the servers list.
The Server Identity pop-up window appears.
Step 3
You have two options:
•
Select the current definition from the
Select Server Type
drop-down list.
•
Select the type of server from the
Select Server Type
drop-down list.
Step 4
Optionally, to only list vendors and products for that server type, select the
Restrict by Server Type
check
box.
Step 5
Optionally, to customize the name and version of the server, select the
Use Custom Display String
and type
a
Vendor String
and
Version String
.
Step 6
In the
Product Mappings
section, select the operating system, product, and versions you want to use.
For example, if you want the server to map to Red Hat Linux 9, select
Redhat, Inc.
as the vendor,
Redhat
Linux
as the product, and
9
as the version.