Cisco Cisco Firepower Management Center 4000

FireSIGHT

When you modify a compliance white list that is included in an active correlation policy, the system 
re-evaluates the target hosts. Note that the system does not generate white list events — and therefore 
does not trigger any responses you associated with the white list — during this re-evaluation, even if the 
white list is included in an active correlation policy and a previously compliant host becomes 
non-compliant with the updated white list.

Admin 

Select 

, then click 

.

The White List page appears.

Next to the white list you want to modify, click the edit icon (

).

The Create White List page appears.

Make modifications as necessary and click 

.

The white list is updated.

FireSIGHT

You cannot delete a compliance white list that you are using in one or more correlation policies; you 
must first delete the white list from all policies where it is used. For information on deleting a white list 
from a policy, see 

.

Deleting a white list also removes the host attribute associated with the white list from all hosts on your 
network.

Admin 

Select 

, then click 

.

The White List page appears.

Next to the white list you want to delete, click the delete icon (

).

The white list is deleted.

FireSIGHT