Cisco Cisco Firepower Management Center 2000

Damage

Unknown

You can also create your own incident types, as explained in 

.

Protection

This section explains how you create an incident.

Admin/Intrusion Admin

Select 

.

The Incidents page appears.

Click 

.

The Create Incident page appears.

If you previously copied intrusion events to the clipboard, they are displayed at the bottom of the page. 
See 

 for information about using the clipboard.

From the 

 drop-down menu, select the option that best describes the incident.

In the 

 field, enter the amount of time you spent on the incident in the #d #h #m #s format, 

where # represents the number of days, hours, minutes, or seconds.

In the 

 text box, type a short description (up to 255 alphanumeric characters spaces, and 

symbols) of the incident.

In the 

 text box, type a more complete description (up to 8191 alphanumeric characters, 

spaces and symbols) for the incident.

Do you want to add events to the incident?

If yes, select the events on the clipboard and click 

.

You can also add all the events from the clipboard by clicking 

.

If no, click 

.

In either case, the incident is saved with the information you entered.

If you want to add individual events from more than one page on the clipboard, you must add 
the events from one page, then add the events from the other pages separately.

Protection

You can update an incident as you collect more information. You can also add or delete events from the 
incident as your investigation progresses.