topic Re: FMC Unified Events filtering in Network Security

FMC Unified Events filtering

Jacob Gibb — Thu, 28 Dec 2023 15:44:54 GMT

Hello,

I am looking to understand where the filters ($(10.x.x.x) are created when filtering in the FMC unified events viewer similar to below. Some networks are there and some are not. In particular, I would like to filter on a subnet in general to view traffic from anyone in that subnet. Thanks.

Re: FMC Unified Events filtering

Eric R. Jones — Thu, 28 Dec 2023 20:09:09 GMT

So I watched the video on this, I need to go back and review it again;however, I do not remember the ability to filter or search for a particular IP address or anything else in this view. I felt that this, a failry ok replacement to the ASDM live view of traffic, wasn't what I want. Can you actually search for/filter for a particular IP or range of IP's?

Re: FMC Unified Events filtering

MHM Cisco World — Fri, 29 Dec 2023 00:29:14 GMT

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-management-center/221068-monitor-events-using-unified-event-viewe.html

MHM

Re: FMC Unified Events filtering

Marvin Rhoads — Fri, 29 Dec 2023 12:47:25 GMT

Just type in the address and subnet mask in CIDR format (a.b.c.d/xy - for example 192.168.1.0/24). The variable objects preceded by $ are created in the event that you have a network object already in existence for the subnet. They are not required to filter though.

Re: FMC Unified Events filtering

Jacob Gibb — Tue, 02 Jan 2024 15:54:18 GMT

Thanks, Marvin. That did it!

Re: FMC Unified Events filtering

Eric R. Jones — Tue, 02 Jan 2024 21:31:22 GMT

thanks for the link. This actually helped me more than the video on the part I was curious about.

Re: FMC Unified Events filtering

ajmn — Mon, 04 Aug 2025 13:33:16 GMT

https://youtu.be/7CAqavq31W8?feature=shared