Cisco Cisco Firepower Management Center 2000
27-23
FireSIGHT System User Guide
Chapter 27 Using the FireSIGHT System as a Compliance Tool
Working with Shared Host Profiles
Modifying a Compliance White List
License:
FireSIGHT
When you modify a compliance white list that is included in an active correlation policy, the system
re-evaluates the target hosts. Note that the system does not generate white list events — and therefore
does not trigger any responses you associated with the white list — during this re-evaluation, even if the
white list is included in an active correlation policy and a previously compliant host becomes
non-compliant with the updated white list.
re-evaluates the target hosts. Note that the system does not generate white list events — and therefore
does not trigger any responses you associated with the white list — during this re-evaluation, even if the
white list is included in an active correlation policy and a previously compliant host becomes
non-compliant with the updated white list.
To modify an existing compliance white list:
Access:
Admin
Step 1
Select
Policies > Correlation
, then click
White List
.
The White List page appears.
Step 2
Next to the white list you want to modify, click the edit icon (
).
The Create White List page appears.
Step 3
Make modifications as necessary and click
Save White List
.
The white list is updated.
Deleting a Compliance White List
License:
FireSIGHT
You cannot delete a compliance white list that you are using in one or more correlation policies; you
must first delete the white list from all policies where it is used. For information on deleting a white list
from a policy, see
must first delete the white list from all policies where it is used. For information on deleting a white list
from a policy, see
.
Deleting a white list also removes the host attribute associated with the white list from all hosts on your
network.
network.
To delete an existing compliance white list:
Access:
Admin
Step 1
Select
Policies > Correlation
, then click
White List
.
The White List page appears.
Step 2
Next to the white list you want to delete, click the delete icon (
).
The white list is deleted.
Working with Shared Host Profiles
License:
FireSIGHT