Query Criteria; Source Ip - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Queries
5.
6.
7.
8.
9.
10.
11.
Repeat this selection process for other query data.
Click the Submit button to run the query.
Step 4

Query Criteria

The following list describes the selections in the Query Event Data table.

Source IP

•
Specifies that the constraints entered are the session endpoints.
•
Specifies that the constraints entered are the source as appearing at the destination.
•
No constraint is placed on the source IP addresses.
•
Signify any one IP address, only useful for queries in tandem with the same variable.
•
IP addresses present on devices in the system or user entered dotted quads.
•
The range of addresses between two dotted quads.
•
Topologically valid networks.
•
The hosts and reporting devices present in the system.
User Guide for Cisco Security MARS Local Controller
20-10
Enter search text, and click Search to move items that match the search criteria from the Sources
Available field to the Sources Selected field.
To add a new item to the sources, click the Add button. To edit or delete an existing source, click
the Edit or Delete button. See
Click an item or items in the Sources Selected field, and use the Remove button.
To move IP values up into the Sources Selected field, click the Equal
Equal (Up) icon.
Check the radio button next to IP or Range, and enter an IP address or a range of IP addresses into
their respective fields.
Select items in the Sources Selected field by clicking them. Enter a group name, and click the
Grouped As button to group them.
Once you have chosen the query criteria that interests you, click Apply to return to the Query page.
Pre NAT source addresses
Post NAT source addresses
ANY
Variables
IP addresses
IP ranges
Networks
Devices
IP Management, page 23-3
Chapter 20 Queries and Reports
for more information.
(Up) icon, or the Not
78-17020-01