Cisco Cisco Firepower Management Center 2000
38-29
FireSIGHT System User Guide
Chapter 38 Working with Discovery Events
Working with Host Attributes
Step 4
Optionally, add notes to the host profiles of the hosts you selected by entering up to 255 alphanumeric
characters, special characters, and spaces in the text box.
characters, special characters, and spaces in the text box.
Step 5
Optionally, set any user-defined host attributes you have configured.
Step 6
Click
Save
.
The host attributes you specified are assigned to the selected hosts.
Searching for Host Attributes
License:
FireSIGHT
You can search for hosts that have specific host attributes. For example, if your company has several
regional offices, you could configure a host attribute that tells you which city any one host resides in.
You could then search for hosts in specific regions. For more information on host attributes, see
regional offices, you could configure a host attribute that tells you which city any one host resides in.
You could then search for hosts in specific regions. For more information on host attributes, see
.
You may want to create searches customized for your network environment, then save them to reuse later.
For more information on the host attribute fields, see
For more information on the host attribute fields, see
General Search Syntax
The system displays examples of valid syntax next to each search field. When entering search criteria,
keep the following points in mind:
keep the following points in mind:
•
All fields accept negation (
!
).
•
All fields accept comma-separated lists. If you enter multiple criteria, the search returns only the
records that match all the criteria.
records that match all the criteria.
•
Many fields accept one or more asterisks (
*
) as wild cards.
•
For some fields, you can specify
n/a
or
blank
in the field to identify events where information is not
available for that field; use
!n/a
or
!blank
to identify the events where that field is populated.
•
Most fields are case-insensitive.
•
IP addresses may be specified using CIDR notation. For information on entering IPv4 and IPv6
addresses in the FireSIGHT System, see
addresses in the FireSIGHT System, see
.
•
Click the add object icon (
) that appears next to a search field to use an object as a search
criterion.
For detailed information on search syntax, including using objects in searches, see
.
To search for host attributes:
Access:
Admin/Any Security Analyst
Step 1
Select
Analysis > Search
.
The Search page appears.
Step 2
From the
Table
drop-down list, select
Host Attributes
.
The page reloads with the appropriate constraints.