Editing Snort 2 Intrusion Policies

Step 1

Choose Policies > Access Control > Intrusion.

Step 2

Ensure the Intrusion Policies tab is selected.

Step 3

Click Snort 2 Version next to the intrusion policy you want to configure.

Step 4

Edit your policy:

• Change the base policy—Choose a base policy from the Base Policy drop-down list; see Changing the Base Policy.
• Configure advanced settings—Click Advanced Settings in the navigation panel; see Intrusion Policy Advanced Settings.
• Configure Cisco recommended intrusion rules—Click Cisco Recommendations in the navigation panel; see Generating and Applying Cisco Recommendations.
• Drop behavior in an inline deployment—Check or clear Drop when Inline; see Setting Drop Behavior in an Inline Deployment.
• Filter rules by recommended rule state—After you generate recommendations, click View next to each recommendation type. Click View Recommended Changes to view all recommendations.
• Filter rules by current rule state—Click View next to each rule state type (generate events, drop and generate events); see Intrusion Rule Filters in an Intrusion Policy.
• Manage policy layers—Click Policy Layers in the navigation panel; see Layer Management.
• Manage intrusion rules—Click Manage Rules; see Viewing Intrusion Rules in an Intrusion Policy.
• View settings in base policy—Click Manage Base Policy; see The Base Layer.

Step 5

To save changes you made in this policy since the last policy commit, choose Policy Information, then click Commit Changes.