Cisco Cisco FirePOWER Appliance 8130
47-30
FireSIGHT System User Guide
Chapter 47 Understanding and Using Workflows
Using Workflows
To change time window preferences during event analysis:
Access:
Admin/Maint/Any Security Analyst
Step 1
On a workflow constrained by time, click the time range icon (
).
The Date/Time window appears.
Step 2
Select the
Preferences
tab and change your preferences, as described in the
table.
Step 3
Click
Save Preferences
.
Your preferences are saved.
Step 4
You have two options:
•
To apply your new default time window settings to the event view you are using, click
Apply
to close
the Date/Time window and refresh the event view.
•
To continue with your analysis without applying the default time window settings, close the
Date/Time window without clicking
Date/Time window without clicking
Apply
.
Pausing the Time Window
License:
Any
You can pause the time window, which allows you to examine a snapshot of the data provided by the
workflow. This is useful because when an unpaused workflow updates, it may remove events that you
want to examine or add events that you are not interested in.
workflow. This is useful because when an unpaused workflow updates, it may remove events that you
want to examine or add events that you are not interested in.
Note that you cannot pause a static time window. In addition, pausing an event time window has no effect
on dashboards, nor does pausing a dashboard have any effect on pausing an event time window.
on dashboards, nor does pausing a dashboard have any effect on pausing an event time window.
When you are finished with your analysis, you can unpause the time window. Unpausing the time
window updates it according to your preferences, and also updates the event view to reflect the unpaused
time window.
window updates it according to your preferences, and also updates the event view to reflect the unpaused
time window.
If the database contains more events than can be displayed on a single workflow page, you can click the
links at the bottom of the page to display more events (see
links at the bottom of the page to display more events (see
). When you do this, the time window automatically pauses so that you do not see the same
events twice. You can unpause the time window when you are ready.
To pause the time window:
Access:
Admin/Maint/Any Security Analyst
Step 1
On the time range control, click the pause icon (
).
The time window is paused until you unpause it.
To unpause the time window:
Access:
Admin/Maint/Any Security Analyst
Step 1
On the time range control, click the play icon (
).