для Cisco Cisco FirePOWER Appliance 7020

Скачать
Страница из 1844
 
41-18
FireSIGHT System User Guide
 
Chapter 41      Configuring Remediations 
  Working with Remediation Status Events
To view remediation status events:
Access: 
Admin 
Step 1
Select 
Analysis > Correlation > Status
.
The first page of the default remediations workflow appears. To use a different workflow, including a 
custom workflow, click 
(switch workflow)
 by the workflow title. For information on specifying a different 
default workflow, see 
. If no events appear, you may need 
to adjust the time range; see 
.
sort and constrain the events
see 
 and 
.
temporarily use a different workflow
click 
(switch workflow) 
by the workflow title. For more information, see 
.
navigate to the correlation events view to 
see associated events
click 
Correlation Events
. For more information, see 
.
bookmark the current page so that you can 
quickly return to it
click 
Bookmark This Page
. For more information, see 
.
navigate to the bookmark management 
page
click 
View Bookmarks
. For more information, see 
generate a report based on the data in the 
table view
click 
Report Designer
. For more information, see 
drill down to the next page in the 
workflow, constraining on a specific value
use one of the following methods:
  •
on a drill-down page that you created in a custom workflow, click a value 
within a row. Note that clicking a value within a row in a table view 
constrains the table view and does not drill down to the next page.
  •
To drill down to the next workflow page constraining on some users, select 
the check boxes next to the users you want to view on the next workflow 
page, then click 
View
.
  •
To drill down to the next workflow page keeping the current constraints, click 
View All
.
Tip
Table views always include “Table View” in the page name.
For more information, see 
delete remediation status events from the 
system
use one of the following methods:
  •
To delete some events, select the check boxes next to events you want to 
delete, then click 
Delete
.
  •
To delete all events in the current constrained view, click 
Delete All
, then 
confirm you want to delete all the events.
search for remediation status events
click 
Search
. For more information, see 
.
Table 41-1
Options for Viewing Remediation Status Events (continued)
To...
You can...