Cisco Cisco Firepower Management Center 4000

Where the condition syntax allows you to pick a value from a drop-down list, you can often use multiple 
values from the list. For more information, see 

For more information on the syntax for building correlation rule trigger criteria, see:

For more information on the syntax for building host profile qualifications, user qualifications, and 
connection trackers, see:

Any

You can create simple correlation rule triggers, connection trackers, host profile qualifications, and user 
qualifications, or you can create more elaborate constructs by combining and nesting conditions.

When your construct includes more than one condition, you must link them with an 

 or an 

 

operator. Conditions on the same level are evaluated together:

The 

 operator requires that all conditions on the level it controls must be met.

The 

 operator requires that at least one of the conditions on the level it controls must be met.

For example, the following correlation rule trigger criteria contains two conditions, linked by 

. This 

means that the rule triggers if either condition is true, that is, if a host with an IP address is not in the 
10.x.x.x subnet or if a host transmits an IGMP message.