Cisco Cisco Firepower Management Center 4000

If you have unsaved changes in another policy, click 

 to discard those changes and continue. See 

 for information on saving unsaved changes in another 

policy.

The Policy Information page appears.

You have two options:

If you have not generated recommendations, select 

.

If you have generated recommendations, select 

.

The FireSIGHT Recommended Rules Configuration page appears.

You have the following choices:

To have the corresponding intrusion policy report list the rule message, recommended state, and 
actual state for all rules whose actual state differs from the recommended state, select

 for more information.

To generate recommendations using the default settings, go to step 

To modify the advanced recommendations options, go to step 

.

Click the plus icon (

) to expand the 

 section.

The advanced FireSIGHT recommendations options appear.

In the 

 field, specify the network to examine for recommendations.

For information on using IP address notation in the FireSIGHT System, see 

.

Note that lists of addresses are linked with an OR operation except for negations, which are linked with 
an AND operation after all OR operations are calculated. See 

 for more information. 

Optionally, drag the 

 slide bar to specify the amount of 

overhead a rule must have to be included in the recommendations you generate.

Dragging the slide bar to the right includes rules with higher overhead and will likely result in more 
recommendations, but may increasingly affect system performance. See 

 for more information.

You have the following options:

To generate recommendations to disable rules, select the 

 

check box.

Note that accepting recommendations to disable rules restricts your rule coverage.

To prevent generating recommendations to disable rules, clear the 

 check box.

Note that omitting recommendations to disable rules augments your rule coverage.

You have several options:

Click 

 if you have not yet generated recommendations and want the 

system to change your rule states automatically to the recommended states while generating 
recommendations. 

The system generates recommended rule state changes and automatically sets rules to the 
recommended states.