topic Re: Searching For Activity From A Specific IP in Network Security

Searching For Activity From A Specific IP

ITSupporter — Tue, 02 Apr 2024 20:11:35 GMT

I'm new to FMC/FTD and I'm looking for ways to search for activity to/from a specific IP. I tried searching in Connection Events but it came up empty. Suggestions will be appreciated.

Re: Searching For Activity From A Specific IP

MHM Cisco World — Tue, 02 Apr 2024 20:18:20 GMT

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-management-center/221068-monitor-events-using-unified-event-viewe.html

Check this

MHM

Re: Searching For Activity From A Specific IP

Eric R. Jones — Tue, 02 Apr 2024 22:05:50 GMT

I have followed this information and have used it; however, seems like some of the choices displayed in the example are no longer available. I'm on version 7.2.5 so when it states that you can save column sets that doesn't appear.

Re: Searching For Activity From A Specific IP

Eric R. Jones — Tue, 02 Apr 2024 22:08:10 GMT

could it be related to this bug, Cisco Bug: CSCwe83592

Re: Searching For Activity From A Specific IP

Pulkit Mittal — Tue, 02 Apr 2024 23:49:43 GMT

You will find this very helpful.

Cisco Secure Firewall - Unified Events Viewer: Tips & Tricks (youtube.com)

If you find this useful, please mark it helpful and accept the solution.

Re: Searching For Activity From A Specific IP

Pulkit Mittal — Tue, 02 Apr 2024 23:51:06 GMT

Also, this one, bit old though.

43- Firepower Advanced Network Analysis Connection Events & Security Intelligence (youtube.com)

If you find this useful, please mark it helpful and accept the solution.

Re: Searching For Activity From A Specific IP

Eric R. Jones — Wed, 03 Apr 2024 03:07:08 GMT

Below is what I see when I access the icon. It doesn't offer the option to save anything.

Checked to see if it is something I set on the widget but so far no that's not it.

Re: Searching For Activity From A Specific IP

MHM Cisco World — Wed, 03 Apr 2024 04:07:44 GMT

I think you misunderstand the search

There is search which search life event log (can not save)

And there is template for event log, This template build new event log with some column you specify.

Hope I am correct here, and I Wil share more details tonight

MHM

Re: Searching For Activity From A Specific IP

Eric R. Jones — Wed, 03 Apr 2024 04:51:29 GMT

thank you