Using Lookups

The following topics explain how to look up information about entities that may or may not be known to the Firepower System:

Introduction to Lookups

If your Firepower Management Center is connected to the Internet, you can use manual lookup features to find the following information:

  • Regional Information Registries (RIR) information (whois) for any IP address.

  • Geolocation information for any IP address: country name, country code, and continent name. (To ensure that you are using up-to-date geolocation information, Cisco strongly recommends that you regularly update the Geolocation Database (GeoDB) on your Firepower Management Center.)

Finding Geolocation Information for an IP Address

You can use the geolocation lookup feature to find the country name, ISO 3166-1 three-digit country code, and continent name associated with any IP address.

Procedure

Step 1

Choose Analysis > Lookup > Geolocation.

Step 2

To view the geolocation information for one or more IP addresses, enter the address or addresses and click Search. You may specify IPv4 addresses, IPv6 addresses, or both. Use a comma, semicolon, return, or any white space character to separate multiple addresses.

Tip

 

Click Clear to clear the text box.

Step 3

Optionally, click the column titles to sort the data. You can sort by any field except IP Address.