Cisco Cisco FirePOWER Appliance 7115
Version 5.3
Sourcefire 3D System User Guide
1589
Configuring Correlation Policies and Rules
Creating Correlation Policies
Chapter 36
The following graphic shows a correlation policy composed of a compliance white
list and a set of correlation rules, configured with a variety of responses.
z
To add responses to rules and white lists:
A
CCESS
: Admin/Discovery Admin
1. On the Create Policy page, next to a rule or white list where you want to add
responses, click the responses icon (
).
A pop-up window appears.
2. Under Unassigned Responses, select the response, multiple responses, or
response group you want to launch when the rule or white list triggers, and
click the up arrow.
TIP!
Hold down the Ctrl key while clicking to select multiple responses.
3. Click Update.
The Create Policy page appears again. The responses you specified are added
to the rule or white list.