Cisco Cisco FirePOWER Appliance 7010
44-15
FireSIGHT System User Guide
Chapter 44 Working with Reports
Using Report Templates
To select the table and output format for a template section:
Access:
Admin/Any Security Analyst
Step 1
Use the
Table
drop-down menu to select the table to query in this section.
Icons appear in the
Format
field for each of the output formats available for the selected table.
Step 2
Select the applicable output format icon for the section. For information about these formats, see the
table.
The fields included in the output appear.
Step 3
To change the search constraints, click the edit icon (
) next to the
Search
or
Filter
field.
The Search Editor pop-up window appears with options for constraining the search. For information on
using this window, see
using this window, see
.
Step 4
For graphic output formats (pie chart, bar chart, and so on), adjust the
X-Axis
and
Y-Axis
parameters using
the drop-down menus.
When you select a value for the X-axis, only compatible values appear in the Y-axis drop-down menu,
and vice versa.
and vice versa.
Step 5
For table output, select the columns, order of appearance, and sort order in your output. For detailed
information, see
information, see
.
Step 6
Click
Save
to save the template.
Your template is saved.
Specifying the Search or Filter for a Template Section
License:
Any
The search or filter in a report section specifies the database query on which the section content is based.
For most tables, you can constrain a report using a predefined or saved search, or you can create a new
search on the fly:
For most tables, you can constrain a report using a predefined or saved search, or you can create a new
search on the fly:
•
Predefined searches serve as examples for searching certain event tables and can provide quick
access to important information about your network that you may want to include in reports.
access to important information about your network that you may want to include in reports.
•
Saved event searches include all public event searches that you or others have created, plus all your
saved private event searches. For information on defining, naming, and using saved event searches,
see
saved private event searches. For information on defining, naming, and using saved event searches,
see
.
•
Saved searches for the current report template are accessible only in the report template itself. The
search names of saved report template searches end with the string “Custom Search.” Users create
these searches while designing reports.
search names of saved report template searches end with the string “Custom Search.” Users create
these searches while designing reports.
For the Application Statistics table, you use a user-defined application filter to constrain a report; for
information on creating filters, see
information on creating filters, see
To specify a search or filter for a template section:
Access:
Admin/Any Security Analyst
Step 1
Select the database table to query from the
Table
drop-down menu:
•
For most tables, the
Search
drop-down list appears.