Cisco Cisco Firepower Management Center 2000

Select the rule or rules for which you want to view or delete suppressions. You have the following 
options:

To select a specific rule, select the check box next to the rule.

To select all rules in the current list, select the check box at the top of the column.

You have two options:

To remove all suppression for a rule, select 

Click 

 in the 

confirmation pop-up window that appears.

To remove a specific suppression setting, highlight the rule and click 

. Expand the 

suppression settings and click 

 next to the suppression settings you want to remove. Click 

 

to confirm that you want to delete your selected settings.

The page refreshes and the suppression settings are deleted.

Save your policy, continue editing, discard your changes, or exit while leaving your changes in the 
system cache. See the 

 table for more information.

Protection

Rate-based attacks attempt to overwhelm a network or host by sending excessive traffic toward the 
network or host, causing it to slow down or deny legitimate requests. You can use rate-based prevention 
to change the action of a rule in response to excessive rule matches for specific rules. 

For more information, see the following sections:

Protection

You can configure your intrusion policies to include a rate-based filter that detects when too many 
matches for a rule occur in a given time period. You can use this feature on managed devices deployed 
inline to block rate-based attacks for a specified time, then revert to a rule state where rule matches only 
generate events and do not drop traffic. 

Rate-based attack prevention identifies abnormal traffic patterns and attempts to minimize the impact of 
that traffic on legitimate requests. You can identify excessive rule matches in traffic going to a particular 
destination IP address or addresses or coming from a particular source IP address or addresses. You can 
also respond to excessive matches for a particular rule across all detected traffic. 

In the intrusion policy, you can configure a rate-based filter for any intrusion or preprocessor rule. The 
rate-based filter contains three components: 

the rule matching rate, which you configure as a count of rule matches within a specific number of 
seconds

a new action to be taken when the rate is exceeded, with three available actions: Generate Events, 
Drop and Generate Events, and Disable