What are properties?

Properties are information such as IP and MAC addresses, hardware and firmware versions, serial number, etc. that qualify devices, components and flows. The sensor extracts flows properties from the packets captured. The Center then deduces components properties and then devices properties out of flows properties. Some properties are normalized for all devices and components and some properties are protocol or vendor specific.

What are properties used for?

Besides from providing further details about devices, components and flows, properties are crucial in Cisco Cyber Vision to generate tags. And combination of properties and tags are used to define behaviors (i.e. in the Monitor mode) inside the industrial network.

Where to find properties?

Properties are visible from devices and components right side panels and technical sheets under the tab Basics.

A component's properties inside its technical sheet with normalized properties on the left column, and protocol and vendor specific properties on the right column:

Note	Protocol and vendor specific properties evolve as more protocols are supported by Cisco Cyber Vision.