Cisco Cisco Firepower Management Center 4000
39-43
FireSIGHT System User Guide
Chapter 39 Configuring Correlation Policies and Rules
Grouping Correlation Responses
Modifying a Response Group
License:
Any
Use the following procedure to modify a response group.
To modify a response group:
Access:
Admin
Step 1
Select
Policies > Correlation
, then click
Groups
.
The Groups page appears.
Step 2
Click the edit icon (
) next to the group you want to modify.
The Response Group page appears.
Step 3
Make changes as needed and click
Save
.
If the group is active and in use, the changes you made take effect immediately.
Deleting a Response Group
License:
Any
You can delete a response group if it is not used in a correlation policy. Deleting a response group does
not delete the responses in the group, just their association with each other.
not delete the responses in the group, just their association with each other.
To delete a response group:
Access:
Admin
Step 1
Select
Policies > Correlation
, then click
Groups
.
The Groups page appears.
Step 2
Click the delete icon (
) next to the group you want to delete.
Step 3
Confirm that you want to delete the group.
The group is deleted.
Activating and Deactivating Response Groups
License:
Any
You can temporarily deactivate a response group without deleting it. This leaves the group on the system
but does not launch it when a policy to which the group is assigned is violated. Note that if a response
group is used in a correlation policy when you deactivate it, it is still considered in use even though it is
deactivated; you cannot delete in-use response groups.
but does not launch it when a policy to which the group is assigned is violated. Note that if a response
group is used in a correlation policy when you deactivate it, it is still considered in use even though it is
deactivated; you cannot delete in-use response groups.
To activate or deactivate a response group:
Access:
Admin