Tuning intrusion rules

Tuning intrusion rules is a configuration process that

enables rule state modification for shared object rules, standard text rules, and inspector rules,
controls event generation and traffic processing based on rule configuration, and
allows filtering of rules to display specific subsets for targeted configuration changes.

Rule state configuration

You enable a rule by setting its rule state to Alert or to Block. Enabling a rule causes the system to generate events on traffic matching the rule. Disabling a rule stops processing of the rule. You can also set your intrusion policy so that a rule set to Block generates events on, and drops, matching traffic.

You can filter rules to display a subset of rules, enabling you to select the exact set of rules where you want to change rule states or rule settings.

When an intrusion rule or rule argument requires a disabled inspector, the system automatically uses it with its current configuration even though it remains disabled in the web user interface (UI) of the network analysis policy.

Note	We recommend that you do not modify shared object rules and you only enable or disable these rules for your threat defense device. To create custom Snort rules, contact Cisco support.