для Cisco Cisco FirePOWER Appliance 8360
21-34
FireSIGHT System User Guide
Chapter 21 Managing Rules in an Intrusion Policy
Managing FireSIGHT Rule State Recommendations
To add a comment to a rule:
Access:
Admin/Intrusion Admin
Step 1
Select
Policies > Intrusion > Intrusion Policy.
The Intrusion Policy page appears.
Step 2
Click the edit icon (
) next to the policy you want to edit.
If you have unsaved changes in another policy, click
OK
to discard those changes and continue. See
for information on saving unsaved changes in another
policy.
The Policy Information page appears.
Step 3
Click
Manage Rules
.
The Rules page appears.
Step 4
Locate the rule or rules where you want to add a comment to a rule. You have the following options:
•
To sort the current display, click on a column heading or icon. To reverse the sort, click again.
•
Construct a filter by clicking on keywords or arguments in the filter panel on the left. For more
information, see the following topics:
information, see the following topics:
.
The page refreshes to display all matching rules.
Step 5
Select the rule or rules to which you want to add a comment:
•
To select a specific rule, select the check box next to the rule.
•
To select all the rules in the current list, select the check box at the top of the column.
Step 6
Select
Comments > Add Rule Comment
.
The Add Comment dialog box appears.
Step 7
Type the rule comment.
Step 8
Click
OK
.
The system adds the comment and displays a comment icon (
) next to the rule in the Comments
column. If you add multiple comments to a rule, a number over the icon indicates the number of
comments.
comments.
Tip
To delete a rule comment, highlight the rule and click
Show Details
, then click
Delete
in the rule comments
section. Note that you can only delete a comment if the comment is cached with uncommitted intrusion
policy changes. After intrusion policy changes are committed, the rule comment is permanent.
policy changes. After intrusion policy changes are committed, the rule comment is permanent.
Step 9
Save your policy, continue editing, discard your changes, or exit while leaving your changes in the
system cache. See the
system cache. See the
table for more information.
Managing FireSIGHT Rule State Recommendations
License:
FireSIGHT + Protection