Cisco Cisco Firepower Management Center 4000

Any

Use the following procedure to either activate or deactivate a correlation policy.

Admin/Discovery Admin

Select 

.

The Policy Management page appears.

Next to the policy you want to activate or deactivate, click the slider.

If the policy was active, it is deactivated. If it was deactivated, it is activated.

Any

Use the following procedure to modify a correlation policy.

Admin/Discovery Admin

Select 

.

The Policy Management page appears.

Click the edit icon (

) next to the policy.

The Create Policy page appears. See 

 for information on the 

various configurations you can change. To remove a rule or white list from a correlation policy, on the 
Create Policy page, click the delete icon (

) next to the rule or white list you want to remove.

Make changes as needed and click 

.

The policy is changed. If the policy is active, the changes you made take effect immediately.

Any

Use the following procedure to delete a correlation policy.

Admin/Discovery Admin

Select 

.