Cisco Cisco FirePOWER Appliance 8130
47-41
FireSIGHT System User Guide
Chapter 47 Understanding and Using Workflows
Using Custom Workflows
Note
If you selected
Vulnerabilities
as the Table Type in step
, then add
IP Address
as a table column,
the IP Address column does not appear when you are viewing vulnerabilities using your custom
workflow, unless you use the search feature to constrain the workflow to view a specific IP
address or block of addresses. For more information on searching for vulnerabilities, see
workflow, unless you use the search feature to constrain the workflow to view a specific IP
address or block of addresses. For more information on searching for vulnerabilities, see
.
Step 7
Optionally, click
Add Table View
to add a table view page to the workflow.
Note
You must add at least one drill-down page or a table view of events to a custom workflow.
Step 8
Click
Save
.
The new workflow is saved and added to the list of custom workflows.
Creating Custom Connection Data Workflows
License:
FireSIGHT
Custom workflows based on connection data are like other custom workflows, except you can include
connection data graph pages as well as drill-down pages and table view pages. You can include as many
of each type of page in the workflow as you want, in any order. Each connection data graph page contains
a single graph, which can be a line graph, bar graph, or pie chart. On line and bar graphs, you may include
more than one dataset. For more information on connection data, including connection summaries,
connection graphs, and datasets, see
connection data graph pages as well as drill-down pages and table view pages. You can include as many
of each type of page in the workflow as you want, in any order. Each connection data graph page contains
a single graph, which can be a line graph, bar graph, or pie chart. On line and bar graphs, you may include
more than one dataset. For more information on connection data, including connection summaries,
connection graphs, and datasets, see
.
Tip
Instead of creating a new custom workflow, you can export a custom workflow from another appliance
and then import it onto your appliance. You can then edit the imported workflow to suit your needs. For
more information, see
and then import it onto your appliance. You can then edit the imported workflow to suit your needs. For
more information, see
To create a custom workflow based on connection data:
Access:
Admin
Step 1
Select
Analysis > Custom > Custom Workflow
.
Step 2
Click
Create Custom Workflow
.
The Edit Custom Workflow page appears.
Step 3
Type a name for the workflow in the
Name
field.
You can use up to 60 alphanumeric characters and spaces.
Step 4
Optionally, type a description for the workflow in the
Description
field.
You can use up to 80 alphanumeric characters and spaces.
Step 5
From the
Table
drop-down list, select
Connection Events
.
Step 6
Optionally, add one or more drill-down pages to the workflow:
•
To add a drill-down page that contains data on individual connections, click
Add Page
.