Cisco Cisco Firepower Management Center 4000

If you have unsaved changes in another policy, click 

 to discard those changes and continue. See 

 for information on saving unsaved changes in another 

policy.

The Policy Information page appears.

Click 

.

The Rules page appears. By default, the page lists the rules alphabetically by message. 

Locate the rule or rules that have a configured threshold you want to view or delete. You have the 
following options:

To sort the current display, click on a column heading or icon. To reverse the sort, click again.

Construct a filter by clicking on keywords or arguments in the filter panel on the left. For more 
information, see the following topics: 

.

The page refreshes to display all matching rules.

Select the rule or rules with a configured threshold you want to view or delete. You have the following 
options:

To select a specific rule, select the check box next to the rule.

To select all the rules in the current list, select the check box at the top of the column.

To remove the threshold for each selected rule, select 

Click 

 in the 

confirmation pop-up window that appears.

To remove a specific threshold, you can also highlight the rule and click 

. Expand the 

threshold settings and click 

 next to the threshold settings. Click 

 to confirm that you want to 

delete the configuration.

The page refreshes and the threshold is deleted.

Save your policy, continue editing, discard your changes, or exit while leaving your changes in the 
system cache. See the 

 table for more information.

Protection

You can suppress intrusion event notification when a specific IP address or range of IP addresses triggers 
a specific rule or preprocessor. This is useful for eliminating false positives. For example, if you have a 
mail server that transmits packets that look like a specific exploit, you can suppress event notification 
for that event when it is triggered by your mail server. The rule triggers for all packets, but you only see 
events for legitimate attacks.

Note that you can use intrusion event suppression alone or in any combination with rate-based attack 
prevention, the 

detection_filter

 keyword, and intrusion event thresholding. See 

for more information.

See the following sections for more information: