Device Group Management

From the Management > Devices > Device Groups tab, you can group log sources into a single virtual log source.

A log source must be part of the Available Devices list before it can be included in a group.

Device Groups are updated dynamically. For example, if you create a device group for all routers, and later add a new router to the appliance, the new router is automatically added to your router device group.

Note: Device groups without a hyperlink are system-generated groups that contain all log sources of a specific type. For example, “All Cisco ESA.” You cannot modify or delete these groups.

You can perform the following tasks on the device group list:

Task Description
Add or modify a device group

  • To add, click the Add New icon .

  • To modify, click the device group name and then edit the required information.

For the detailed procedure, see Adding or Modifying a Device Group.
Modify a device group

From the Device Groups tab, click the name of the device group. The Modify Device Group tab appears. Enter your changes and click the Update Device button.

Note: You cannot modify system-generated groups.
View devices in a group Click the List link in the Devices column.
Filter the groups using the Find field You can quickly find the desired group by typing the group name in the Find field. As you start typing a group name or group description in the Find field, the Device Groups page is automatically refreshed showing your selection.
Remove a device group

Select the group by clicking its check box and then click the Remove icon.

Note: You cannot delete system-generated groups.

If you are running a Management Station, you can multi-select and group log sources across appliances. These global groups are accessible only from the Management Station on which the global group is created. To view global groups in a search or report, you must select All Appliances in the Appliance field.

When a Management Station is reverted to being a regular appliance, its global groups are still visible but can only be deleted. When the appliance becomes a Management Station again, the global groups can be used and modified as before.