Cisco Cisco Firepower Management Center 4000

Admin/Intrusion Admin

Select 

The Intrusion Policy page appears.

Click the edit icon (

) next to the policy you want to edit.

If you have unsaved changes in another policy, click 

 to discard those changes and continue. See 

 for information on saving unsaved changes in another 

policy.

The Policy Information page appears.

Click 

.

The Rules page appears.

Locate the rule or rules where you want to add a comment to a rule. You have the following options:

To sort the current display, click on a column heading or icon. To reverse the sort, click again.

Construct a filter by clicking on keywords or arguments in the filter panel on the left. For more 
information, see the following topics: 

.

The page refreshes to display all matching rules.

Select the rule or rules to which you want to add a comment: 

To select a specific rule, select the check box next to the rule.

To select all the rules in the current list, select the check box at the top of the column.

Select 

.

The Add Comment dialog box appears.

Type the rule comment.

Click 

.

The system adds the comment and displays a comment icon (

) next to the rule in the Comments 

column. If you add multiple comments to a rule, a number over the icon indicates the number of 
comments.

To delete a rule comment, highlight the rule and click 

, then click 

 in the rule comments 

section. Note that you can only delete a comment if the comment is cached with uncommitted intrusion 
policy changes. After intrusion policy changes are committed, the rule comment is permanent.

Save your policy, continue editing, discard your changes, or exit while leaving your changes in the 
system cache. See the 

 table for more information.

FireSIGHT + Protection