Cisco Cisco FirePOWER Appliance 7020
40-9
FireSIGHT System User Guide
Chapter 40 Creating Traffic Profiles
Editing a Traffic Profile
Deactivate a profile when you want it to stop collecting and evaluating connection data. Rules written
against deactivated traffic profiles do not trigger. In addition, deactivating a traffic profile deletes all data
collected and aggregated by the profile. If you later reactivate a deactivated traffic profile, you must wait
the length of its PTW before rules written against it will trigger.
against deactivated traffic profiles do not trigger. In addition, deactivating a traffic profile deletes all data
collected and aggregated by the profile. If you later reactivate a deactivated traffic profile, you must wait
the length of its PTW before rules written against it will trigger.
To activate or deactivate a traffic profile:
Access:
Admin/Discovery Admin
Step 1
Select
Policies > Correlation
, then click
Traffic Profiles
.
The Traffic Profiles page appears.
Step 2
You have two options:
•
To activate an inactive traffic profile, click
Activate
next to the profile.
•
To deactivate an active traffic profile, click
Deactivate
next to the profile. Confirm that you want to
deactivate the profile by clicking
OK
.
Editing a Traffic Profile
License:
FireSIGHT
You cannot substantially edit an active traffic profile; if the traffic profile is active you can only change
its name and description. To edit a traffic profile’s conditions options, you must first deactivate it. Note
that deactivating a traffic profile deletes all the data it has collected.
its name and description. To edit a traffic profile’s conditions options, you must first deactivate it. Note
that deactivating a traffic profile deletes all the data it has collected.
For more information on activating and deactivating traffic profiles, see
.
To edit a traffic profile:
Access:
Admin/Discovery Admin
Step 1
Select
Policies > Correlation
, then click
Traffic Profiles
.
The Traffic Profiles page appears.
Step 2
Next to the traffic profile you want to edit, click
Edit
.
The Create Profile page appears.
Step 3
Make changes to the profile and click
Save
.
Your profile is updated.
Understanding Condition-Building Mechanics
License:
FireSIGHT
You build traffic profiles by specifying the conditions they use to collect data. You can create either
simple conditions or more elaborate constructs with nested conditions.
simple conditions or more elaborate constructs with nested conditions.