Edit A Rule - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Working with System and User Inspection Rules
You cannot delete a rule after it is created by Duplicate or Add.
Note
To duplicate a rule, follow these steps:
Select the checkbox of the rule to duplicate.
Step 1
Click Duplicate.
Step 2
The name of duplicated rule is the name of the original rule extended with a timestamp of when the
original was duplicated (for example, System Rule: Client Exploit - Sasser Worm Copied:
05.10.05/16:54:21). The name can be changed by editing the duplicate rule.

Edit a Rule

You can edit rules with inline editing, or with the rule wizard. To edit inline, you click the argument to
edit. The rule wizard is invoked by selecting a rule to edit then clicking Edit. The rule wizard begins
with the Rule Name field and progress through each subsequent field.
Note You only edit the Source IP, Destination IP, and Device fields of a system inspection rule. See
a Rule, page 21-17
A rule cannot be deleted, it can be made active or inactive.
Note
Edit a Rule with Inline Editing
You can perform inline editing to rules from the Incidents Detail page, or from the Inspections Rules
page. To edit a rule with the Inline Editing, follow these steps:
Click the Rule argument that you want to edit.
Step 1
The edit page for the selected field appears.
Change the argument, then click Apply.
Step 2
Repeat
Step 3
Add Open and Close parentheses as required then click Submit.
Step 4
If no parentheses are required, just click Submit.
Click Activate to include the rule in event correlation processing.
Step 5
Edit a Rule with the Rule Wizard
The Rule Wizard can only be invoked from the Inspections Rule page.
To edit a rule with the Rule Wizard, follow these steps:
Step 1 Select the check box of the rule to edit.
User Guide for Cisco Security MARS Local Controller
21-18
for further information on modifying system inspection rules.
Step 1 as required.
Chapter 21 Rules
Duplicate
78-17020-01