Rule group reporting

Rule group reporting is a security analysis feature that

  • reflects rule groups in generated intrusion events,

  • includes MITRE tactics and techniques identification, and

  • provides dedicated columns for both MITRE and non-MITRE rule groups in intrusion event displays.

Rule group reporting access and fields

To access the intrusion events, in Firewall Management Center, go to Events & Logs > + Show more > Intrusion > Events, and click the Table View of Events tab. You can also view the intrusion event fields in the Unified Events viewer. In the Analysis tab, click Unified Events.

In the Intrusion Events page, these fields are added for rule group reporting. Note that you must explicitly enable the mentioned columns:

  • MITRE ATT&CK

  • Rule Group

For information about these fields, see the section Intrusion Event Fields in the Cisco Secure Firewall Management Center Administration Guide, 7.3.