Cisco Cisco Firepower Management Center 4000
39-40
FireSIGHT System User Guide
Chapter 39 Configuring Correlation Policies and Rules
Managing Rules for Correlation Policies
The Create Rule page appears again. Your selections appear in the value field of your condition.
Managing Rules for Correlation Policies
License:
Any
Use the Rule Management page to manage correlation rules used within correlation policies. You can
create, modify, and delete rules. You can also create rule groups to help you organize correlation rules.
For more information on modifying rules, deleting rules, and creating rule groups, see:
create, modify, and delete rules. You can also create rule groups to help you organize correlation rules.
For more information on modifying rules, deleting rules, and creating rule groups, see:
•
•
•
For more information on creating rules, see
Modifying a Rule
License:
Any
Use the following procedure to modify an existing correlation rule.
To modify an existing rule:
Access:
Admin/Discovery Admin
Step 1
Select
Policies > Correlation
,
then select the
Rule Management
tab.
The Rule Management page appears.
Step 2
If the rule is in a rule group, click the group name to expand the group.
Step 3
Next to the rule you want to modify, click the edit icon (
).
The Create Rule page appears.
Step 4
Make modifications as necessary and click
Save
.
The rule is updated.
Deleting a Rule
License:
Any
You cannot delete correlation rules that you are using in one or more correlation policies; you must first
delete the rule from all policies in which it is included. For information on deleting a rule from a policy,
see
delete the rule from all policies in which it is included. For information on deleting a rule from a policy,
see
To delete an existing rule:
Access:
Admin/Discovery Admin