The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The following topics describe how to use the network map:
Any.
Leaf
Admin
Discovery Admin
The system monitors traffic traveling over your network, decodes the traffic data, and then compares the data to established operating systems and fingerprints. The system then uses this data to build a detailed representation of your network, called a network map. In multidomain deployments, the system creates an individual network map for each leaf domain.
The system gathers data from the managed devices identified for monitoring in the network discovery policy. The managed devices detect network assets directly from monitored traffic and indirectly from processed NetFlow records. If multiple devices detect the same network asset, the system combines the information into a composite representation of the asset.
To augment data from passive detection, you can:
Actively scan hosts using the open-source scanner, Nmap™, and add the scan results to your network map.
Manually add host data from a third-party application using the host input feature.
The network map displays your network topology in terms of detected hosts and network devices.
You can use the network map to:
Obtain a quick, overall view of your network.
Select different views to suit the analysis you want to perform. Each view of the network map has the same format: a hierarchical tree with expandable categories and sub-categories. When you click a category, it expands to show you the sub-categories beneath it.
Organize and identify subnets via the custom topology feature. For example, if each department in your organization uses a different subnet, you can assign familiar labels to those subnets using the custom topology feature.
View detailed information by drilling down to any monitored host's host profile.
Delete an asset if you are no longer interested in investigating it.
 Note |
If the system detects activity associated with a host you deleted from a network map, it re-adds the host to the network map. Similarly, deleted applications are re-added to the network map if the system detects a change in the application (for example, if an Apache web server is upgraded to a new version). Vulnerabilities are reactivated on specific hosts if the system detects a change that makes the host vulnerable. |
 Tip |
If you want to permanently exclude a host or subnet from the network map, modify the network discovery policy. You may wish to exclude load balancers and NAT devices from monitoring if you find that they are generating excessive or irrelevant events. |
The network map on the Hosts tab displays a host count and a list of host IP addresses and primary MAC addresses. Each address or partial address is a link to the next level. This network map view provides a count of all unique hosts detected by the system, regardless of whether the hosts have one IP address or multiple IP addresses.
Use the hosts network map to view the hosts on your network, organized by subnet in a hierarchical tree, as well as to drill down to the host profiles for specific hosts.
The system can add hosts to the network map from exported NetFlow records, but the available information for these hosts is limited; see Differences between NetFlow and Managed Device Data.
By creating a custom topology for your network, you can assign meaningful labels to your subnets, such as department names, that appear in the hosts network map. You can also view the hosts network map according to the organization you specified in the custom topology.
You can delete entire networks, subnets, or individual hosts from the hosts network map. For example, if you know that a host is no longer attached to your network, you can delete it to simplify your analysis. If the system afterwards detects activity associated with the deleted host, it re-adds the host to the network map. If you want to permanently exclude a host or subnet from the network map, modify the network discovery policy.
 Caution |
Do not delete network devices from the network map. The system uses them to determine network topology. |
On the hosts network map page, you can search only for primary MAC addresses, and the Hosts [MAC] counter includes only primary MAC addresses. For descriptions of primary and secondary MAC addresses, see Basic Host Information in the Host Profile.
The network map on the Network Devices tab displays the network devices (bridges, routers, NAT devices, and load balancers) that connect one segment of your network to another. The map contains two sections listing devices identified by an IP address and devices identified by a MAC address.
The map also provides a count of all unique network devices detected by the system, regardless of whether the devices have one IP address or multiple IP addresses.
If you create a custom topology for your network, the labels you assign to your subnets appear in the network devices network map.
The methods the system uses to distinguish network devices include:
the analysis of Cisco Discovery Protocol (CDP) messages, which can identify network devices and their types (Cisco devices only)
the detection of the Spanning Tree Protocol (STP), which identifies a device as a switch or bridge
the detection of multiple hosts using the same MAC address, which identifies the MAC address as belonging to a router
the detection of TTL value changes from the client side, or TTL values that change more frequently than a typical boot time, which identify NAT devices and load balancers
If a network device communicates using CDP, it may have one or more IP addresses. If it communicates using STP, it may only have a MAC address.
You cannot delete network devices from the network map, because the system uses their locations to determine network topology.
The host profile for a network device has a Systems section rather than an Operating Systems section, which includes a Hardware column that reflects the hardware platform for any mobile devices detected behind the network device. If a value for a hardware platform is listed under Systems, that system represents a mobile device or devices detected behind the network device. Note that mobile devices may or may not have hardware platform information, but hardware platform information is never detected for systems that are not mobile devices.
The network map on the Mobile Devices tab displays mobile devices attached to your network. This network map also provides a count of all unique mobile devices detected by the system, regardless of whether the devices have one IP address or multiple IP addresses.
Each address or partial address is a link to the next level. You can also delete a subnet or IP address; if the system rediscovers the device, it re-adds the device to the network map.
You can also drill down to view the host profiles for the mobile devices.
To identify mobile devices, the system:
analyzes User-Agent strings in HTTP traffic from the mobile device’s mobile browser
monitors the HTTP traffic of specific mobile applications
If you create a custom topology for your network, the labels you assign to your subnets appear in the mobile devices network map.
The network map on the Indications of Compromise tab displays the compromised hosts on your network, organized by IOC category. Affected hosts are listed beneath each category. Each address or partial address is a link to the next level.
From the indications of compromise network map, you can view the host profile of each host determined to have been compromised in a specific way. You can also delete (mark as resolved) any IOC category or any specific host, which removes the IOC tag from the relevant hosts. For example, you can delete an IOC category from the network map if you have determined that the issue is addressed and unlikely to recur.
Marking a host or IOC category resolved from the network map does not remove it from your network. A resolved host or IOC category reappears in the network map if your system newly detects information that triggers that IOC.
For more information about how the system determines indications of compromise, see Indications of Compromise Data and subtopics.
The network map on the Application Protocols tab displays the applications running on your network, organized in a hierarchical tree by application name, vendor, version, and finally by the hosts running each application.
The applications that the system detects may change with system software and VDB updates, and if you import any add-on detectors. The release notes or advisory text for each system or VDB update contains information on any new and updated detectors. For a comprehensive up-to-date list of detectors, see the Cisco Support Site (http://www.cisco.com/cisco/web/support/index.html).
From this network map, you can view the host profile of each host that runs a specific application.
You can also delete any application category, any application running on all hosts, or any application running on a specific host. For example, you can delete an application from the network map if you know it is disabled on the host and you want to make sure the system does not use it for impact level qualification.
Deleting an application from the network map does not remove it from your network. A deleted application reappears in the network map if your system detects a change in the application (for example, if an Apache web server is upgraded to a new version) or if you restart your system’s discovery function.
Depending on what you delete, the behavior differs:
Application Category — Deleting removes the application category from the network map. All applications that reside beneath the category are removed from any host profile that contains the applications.
For example, if you delete http, all applications identified as http are removed from all host profiles and http no longer appears in the applications view of the network map.
Specific Application, Vendor, or Version — Deleting removes the affected application from the network map and from any host profiles that contain it.
For example, if you expand the http category and delete Apache, all applications listed as Apache with any version listed beneath Apache are removed from any host profiles that contain them. Similarly, if instead of deleting Apache, you delete a specific version (1.3.17, for example), only the version you selected will be deleted from affected host profiles.
Specific IP Address — Deleting the IP address removes it from the application list and removes the application itself from the host profile of the IP address you selected.
For example, if you expand http, Apache, 1.3.17 (Win32), and then delete 172.16.1.50:80/tcp, the Apache 1.3.17 (Win32) application is deleted from the host profile of IP address 172.16.1.50.
The network map on the Vulnerabilities tab displays vulnerabilities that the system has detected on your network, organized by legacy vulnerability ID (SVID), CVE ID, or Snort ID.
From this network map, you can view the details of specific vulnerabilities, as well as the host profile of any host subject to a specific vulnerability. This information can help you evaluate the threat posed by that vulnerability to specific affected hosts.
If you determine that a specific vulnerability is not applicable to the hosts on your network (for example, you have applied a patch), you can deactivate the vulnerability. Deactivated vulnerabilities still appear on the network map, but the IP addresses of their previously affected hosts appear in gray italics. The host profiles for those hosts show deactivated vulnerabilities as invalid, though you can manually mark them as valid for individual hosts.
If there is an identity conflict for an application or operating system on a host, the system lists the vulnerabilities for both potential identities. When the identity conflict is resolved, the vulnerabilities remain associated with the current identity.
By default, the network map displays the vulnerabilities of a detected application only if the packet contains the application’s vendor and version. However, you can configure the system to list the vulnerabilities for applications lacking vendor and version data by enabling the vulnerability mapping setting for the application in the management center configuration.
The numbers next to a vulnerability ID (or range of vulnerability IDs) represent two counts:
The first number is a count of non-unique hosts that are affected by a vulnerability or vulnerabilities. If a host is affected by more than one vulnerability, it is counted multiple times. Therefore, it is possible for the count to be higher than the number of hosts on your network. Deactivating a vulnerability decrements this count by the number of hosts that are potentially affected by the vulnerability. If you have not deactivated any vulnerabilities for any of the potentially affected hosts for a vulnerability or range of vulnerabilities, this count is not displayed.
The second number is a count of the total number of non-unique hosts that the system has determined are potentially affected by a vulnerability or vulnerabilities.
Deactivating a vulnerability renders it inactive only for the hosts you designate. You can deactivate a vulnerability for all hosts that have been judged vulnerable or for a specified individual vulnerable host. After a vulnerability is deactivated, the applicable hosts’ IP addresses appear in gray italics in the network map. In addition, host profiles for those hosts show deactivated vulnerabilities as invalid.
If the system subsequently detects the vulnerability on a host where it has not been deactivated (for example, on a new host in the network map), the system activates the vulnerability for that host. You have to explicitly deactivate the newly discovered vulnerability. Also, if the system detects an operating system or application change for a host, it may reactivate associated deactivated vulnerabilities.
The network map on the Host Attributes tab displays the hosts on your network organized by either user-defined or compliance allow list host attributes. You cannot organize hosts using predefined host attributes in this display.
When you choose the host attribute you want to use to organize your hosts, the management center lists the possible values for that attribute in the network map and groups hosts based on their assigned values. For example, if you choose to organize your hosts by allow list host attributes, the system displays them in categories of Compliant, Non-Compliant, and Not Evaluated.
You can also view the host profile of any host assigned a specific host attribute value.
You must be an Admin or Security Analyst user to view the network map.
|
Step 1 |
Choose . |
|
Step 2 |
Click the network map you want to view. |
|
Step 3 |
Continue as appropriate:
|
Use the custom topology feature to help you organize and identify subnets in your hosts and network devices network maps.
For example, if each department within your organization uses a different subnet, you can label those subnets using the custom topology feature.
You can also view the hosts network map according to the organization you specified in the custom topology.
You can specify a custom topology’s networks using any or all of the following strategies:
You can import networks from the network discovery policy to add the networks that you configured the system to monitor.
You can add networks to your topology manually.
The Custom Topology page lists your custom topologies and their status. If the light bulb icon next to the policy name is lit, the topology is active and affects your network map. If it is dimmed, the topology is inactive.
|
Step 1 |
Choose . In a multidomain deployment, if you are not in a leaf domain, the system prompts you to switch. |
|
Step 2 |
Click Custom Topology in the toolbar. |
|
Step 3 |
Click Create Topology. |
|
Step 4 |
Enter a Name. |
|
Step 5 |
Optionally, enter a Description. |
|
Step 6 |
Add networks to your topology. You can use any or all of the following strategies:
|
|
Step 7 |
Click Save. |
Activate the topology as described in Activating and Deactivating Custom Topologies.
|
Step 1 |
Access the custom topology to which you want to import the network:
|
|
Step 2 |
Click Import Policy Networks. |
|
Step 3 |
Click Load. The system displays the topology information for the network discovery policy. |
|
Step 4 |
Refine your topology:
|
|
Step 5 |
Click Save. |
Activate the topology as described in Activating and Deactivating Custom Topologies.
|
Step 1 |
Access the custom topology where you want to add the network:
|
|
Step 2 |
Click Add Network. |
|
Step 3 |
If you want to add a custom label for the network in the hosts and network devices network maps, type a Name. |
|
Step 4 |
Enter the IP Address and Netmask (IPv4) that represent the network you want to add. |
|
Step 5 |
Click Add. |
|
Step 6 |
Click Save. |
Activate the topology as described in Activating and Deactivating Custom Topologies.
Note |
Only one custom topology can be active at any time. If you have created multiple topologies, activating one automatically deactivates the currently active topology. |
|
Step 1 |
Choose . In a multidomain deployment, if you are not in a leaf domain, the system prompts you to switch. |
|
Step 2 |
Choose Custom Topology. |
|
Step 3 |
Click the slider next to a topology to activate or deactivate it. |
Changes you make to an active topology take effect immediately.
|
Step 1 |
Choose . In a multidomain deployment, if you are not in a leaf domain, the system prompts you to switch. |
|
Step 2 |
Click Custom Topology. |
|
Step 3 |
Click Edit ( |
|
Step 4 |
Edit the topology as described in Creating Custom Topologies. |
|
Step 5 |
Click Save. |
Feedback