Table of Contents
Advertisement
Working with System and User Inspection Rules
Figure 21-6
10
9
The following numbers correspond to the numbers shown in
1.
Check the boxes next to the items in the Sources Selected field to select them, and click the Toggle
Equal button to change them between equal and not equal.
2.
Click the Select All button to select all items in the Sources Selected field. Items selected in the
Sources Selected field are deselected when you click Select All.
Use the Equal and Not Equal buttons to bring highlighted items from the Sources Available field
3.
into the Sources Selected field.
4.
Filter sources from this drop-down list.
5.
Enter search text, and click Enter to move items that match the search criteria from the Sources
Available field to the Sources Selected field.
6.
To add a new item to the sources, click the Add button. To edit or delete an existing source, click
the Edit or Delete button.
7.
Click an item or items in the Sources Selected field, and use the Remove button.
8.
To move IP values up into the Sources Selected field, click the Equal
Not Equal
9.
Check the radio button next to IP or Range, and enter an IP address or a range of IP addresses into
their respective fields.
10.
Select items in the Sources Selected field by clicking them. Enter a group name, and click the
Grouped As button to group them.
Step 5
Follow the wizard, and select the values for the rule, clicking the Next button to progress to the next step.
When you are asked, "Are you done defining the rule conditions," you can:
Step 6
User Guide for Cisco Security MARS Local Controller
21-20
User Inspection Rule Wizard Form
1
2
up icon.
Click the Yes button for a single line rule. Continue to add repetition requirements (counts),
–
alert information, and valid time ranges for each line.
3
8
7
Chapter 21
4
5
6
Figure
21-6.
up icon, or the
Rules
78-17020-01
Advertisement
Table of Contents
Troubleshooting
