Cisco Cisco FirePOWER Appliance 7020
38-56
FireSIGHT System User Guide
Chapter 38 Working with Discovery Events
Working with Users
•
telephone number
The number of users the Defense Center can store in its database depends on your FireSIGHT license.
Note that AIM, Oracle, and SIP logins create duplicate user records because they are not associated with
any of the user metadata that the system obtains from LDAP servers. To prevent overuse of user count
because of duplicate user records from these protocols, disable logging of the protocols in the network
discovery policy. For more information, see
Note that AIM, Oracle, and SIP logins create duplicate user records because they are not associated with
any of the user metadata that the system obtains from LDAP servers. To prevent overuse of user count
because of duplicate user records from these protocols, disable logging of the protocols in the network
discovery policy. For more information, see
You can search, view, and delete users from the database; you can also purge all users from the database.
For more information, see the following sections:
For more information, see the following sections:
•
•
•
•
Viewing Users
License:
FireSIGHT
You can view a table of users, and then manipulate the event view depending on the information you are
looking for.
looking for.
The page you see when you access users differs depending on the workflow you use. You can use the
predefined workflow, which includes a table view of users that lists all detected users, and terminates in
a user details page. The user details page provides information on every user that meets your constraints.
predefined workflow, which includes a table view of users that lists all detected users, and terminates in
a user details page. The user details page provides information on every user that meets your constraints.
You can also create a custom workflow that displays only the information that matches your specific
needs. For information on creating a custom workflow, see
needs. For information on creating a custom workflow, see
.
For more information about the contents of the columns in the table, see
.The following table, see describes some of the specific actions you can perform on an users
workflow page. You can also perform the actions in the
table.
To view users:
Access:
Admin/Any Security Analyst
Step 1
Select
Analysis > Users > Users
.
The first page of the default users workflow appears. To use a different workflow, including a custom
workflow, click
workflow, click
(switch workflow)
. For information on specifying a different default workflow, see
Tip
If you are using a custom workflow that does not include the table view of users, click
(switch workflow)
,
then select
Users
.
Understanding the Users Table
License:
FireSIGHT