Cisco Cisco FirePOWER Appliance 8360
47-22
FireSIGHT System User Guide
Chapter 47 Understanding and Using Workflows
Using Workflows
Tip
In event views, hover your pointer over the flag icon to view a tooltip with the country’s name.
The Geolocation Details page appears in a new window.
Using Table View Pages
License:
Any
Table views include a column for each of the fields in the database if the column is enabled by default.
Note that when you disable a column on a table view, the FireSIGHT System adds the Count column to
the event view if disabling the column would create two or more identical rows. When you click on a
value in a table view page, you constrain by that value. When you create a custom workflow, you add a
table view to it by clicking
Note that when you disable a column on a table view, the FireSIGHT System adds the Count column to
the event view if disabling the column would create two or more identical rows. When you click on a
value in a table view page, you constrain by that value. When you create a custom workflow, you add a
table view to it by clicking
Add Table View
.
Table view pages provide some additional features not available on drill-down, host view, packet view,
or vulnerability detail pages. The following table provides more information on those features.
or vulnerability detail pages. The following table provides more information on those features.
Using Drill-Down Pages
License:
Any
Drill-down pages contain a subset of columns that are available in the database. Note that drill-down
pages for predefined workflows always have a Count column. Drill-down pages allow you to narrow the
scope of events you are viewing and to move forward in the workflow. If you click on a value in a
drill-down page, for example, you constrain by that value and move to the next page in the workflow,
focusing more closely on events that match your selected values. Clicking a value in a drill-down page
does not disable the column where the value is, even if the page you advance to is a table view. When
you create a custom workflow, you add a drill-down page to it by clicking
pages for predefined workflows always have a Count column. Drill-down pages allow you to narrow the
scope of events you are viewing and to move forward in the workflow. If you click on a value in a
drill-down page, for example, you constrain by that value and move to the next page in the workflow,
focusing more closely on events that match your selected values. Clicking a value in a drill-down page
does not disable the column where the value is, even if the page you advance to is a table view. When
you create a custom workflow, you add a drill-down page to it by clicking
Add Page
.
For more information on using features on drill-down pages to constrain the set of events as you go
through a workflow, see
through a workflow, see
.
Table 47-24
Additional Table View Page Features
Feature
Description
Click this icon in the column heading that you want to hide. In the pop-up window that
appears, click
appears, click
Apply
.
Tip
To hide or show other columns, select or clear the appropriate check boxes
before you click
before you click
Apply
.
Disabled
Columns list
Columns list
When you remove columns from a page, or columns are disabled by default, the
column names appear in the Disabled Columns list, which is located above the table
and hidden by default.
column names appear in the Disabled Columns list, which is located above the table
and hidden by default.
To add a disabled column back to the event view, click the Search Constraints expand
arrow (
arrow (
) to expand the search constraints, then click the column name under
Disabled Columns.
for more information.