Create a custom snort 3 intrusion policy

Create a custom Snort 3 intrusion policy to tailor intrusion detection and prevention settings to your network security requirements.

Snort 3 intrusion policies define how the system inspects traffic and responds to potential threats. You can create custom policies based on existing system-provided policies or other custom policies to meet specific security needs.

Before you begin

Follow these steps to create a custom Snort 3 intrusion policy:

Procedure

Step 1

Choose Policies > Security policies > Intrusion.

Step 2

Click Create Policy.

Step 3

Enter a unique Name and, optionally, a Description.

Step 4

Choose the Inspection Mode.

The selected action determines whether intrusion rules block and alert (Prevention mode) or only alert (Detection mode).

Note	Before selecting the prevention mode, you might want block rules to alert only so you can identify rules that cause many false positives.

Step 5

Choose the Base Policy.

You can use either a system-provided policy or an existing policy as your base policy.

Step 6

Click Save.

The new policy has the same settings as its base policy.

What to do next

To customize the policy, see Edit Snort 3 Intrusion Policies.