Cisco Cisco Firepower Management Center 4000
39-49
FireSIGHT System User Guide
Chapter 39 Configuring Correlation Policies and Rules
Managing Correlation Policies
Activating and Deactivating Correlation Policies
License:
Any
Use the following procedure to either activate or deactivate a correlation policy.
To activate or deactivate a policy:
Access:
Admin/Discovery Admin
Step 1
Select
Policies > Correlation
.
The Policy Management page appears.
Step 2
Next to the policy you want to activate or deactivate, click the slider.
If the policy was active, it is deactivated. If it was deactivated, it is activated.
Editing a Correlation Policy
License:
Any
Use the following procedure to modify a correlation policy.
To edit a policy:
Access:
Admin/Discovery Admin
Step 1
Select
Policies > Correlation
.
The Policy Management page appears.
Step 2
Click the edit icon (
) next to the policy.
The Create Policy page appears. See
for information on the
various configurations you can change. To remove a rule or white list from a correlation policy, on the
Create Policy page, click the delete icon (
Create Policy page, click the delete icon (
) next to the rule or white list you want to remove.
Step 3
Make changes as needed and click
Save
.
The policy is changed. If the policy is active, the changes you made take effect immediately.
Deleting a Correlation Policy
License:
Any
Use the following procedure to delete a correlation policy.
To delete a policy:
Access:
Admin/Discovery Admin
Step 1
Select
Policies > Correlation
.