Cisco Cisco Firepower Management Center 4000
39-38
FireSIGHT System User Guide
Chapter 39 Configuring Correlation Policies and Rules
Creating Rules for Correlation Policies
The result is:
To add a complex condition:
Access:
Admin/Discovery Admin
Step 1
Click
Add complex condition
above the current condition.
A complex condition is added below the current set of conditions. The complex condition comprises two
subconditions, which are linked to each other with the opposite operator from the one used to link the
conditions on the level above it.
subconditions, which are linked to each other with the opposite operator from the one used to link the
conditions on the level above it.
For example, if you add a complex condition to the following rule:
The result is: