Cisco Cisco FirePOWER Appliance 8360
14-25
FireSIGHT System User Guide
Chapter 14 Understanding and Writing Access Control Rules
Working with Different Types of Conditions
Note that selecting a custom application filter disables the search fields; this is because you cannot add
a filter to a selected custom filter.
a filter to a selected custom filter.
Step 3
Optionally, constrain the list of applications displayed in the
Available Applications
list. You have the
following choices:
•
Click the arrow next to a filter type to expand it, then select or clear the check box next to each filter
whose applications you want to display or hide.
whose applications you want to display or hide.
Note that a number beside each filter indicates the number of applications in the filter.
•
Right-click a Cisco-provided filter type (
Risks
,
Business Relevance
,
Types
,
Categories
, or
Tags
) and
click
Check All
or
Uncheck All
. For more information on Cisco-provided filter types, see the
table.
The Available Applications list updates in the following ways:
•
The list includes the applications in currently selected filters.
•
An
All apps matching the filter
selection appears; this available condition includes all applications and
filters currently displayed in the Available Applications list.
Note that you cannot select or add individual applications in combination with
All apps matching the
filter
; note also that, although you can add each separately, doing so will result in duplicate rule
conditions. The system reduces duplicate conditions to a single condition when you apply your
access control policy.
access control policy.
•
A number above the Available Applications list indicates the number of applications in the currently
displayed list.
displayed list.
Step 4
Optionally, click the information icon (
) next to an application in the
Available Applications
list.
A pop-up window appears with summary information about the application. You have the following
choices:
choices:
•
To display additional information, click any of the Internet search links provided.
•
To exit the pop-up window and return to the Applications page, click the close icon (
) or click
another location within the
Available Applications
list.
Step 5
Click an application in the
Available Applications
list. Use the Shift and Ctrl keys to select multiple
applications, or right-click to select all currently displayed applications. Note that you can add a
maximum of 50 conditions.
maximum of 50 conditions.
Step 6
You have the following choices:
•
Click
Add to Rule
.
•
Drag and drop selected conditions into the
Selected Applications and Filters
list.
Selected conditions are added. Filters appear under the heading Filters, and applications appear under
the heading Applications.
the heading Applications.
Step 7
Optionally, click the add icon (
) above the
Selected Applications and Filters
list to add a custom filter
comprised of all the individual applications and filters currently in the Selected Applications and Filters
list.
list.
Custom filters you create from the Applications conditions page or using the object manager appear
under the User-Created Filters heading in the Application Filters list.
under the User-Created Filters heading in the Application Filters list.
See
object manager. See
for information on adding filters from
conditions pages.
Step 8
Save or continue editing the rule.