Manually Update Intrusion Rules

Use this procedure to perform an on-demand intrusion rule update.

Before you begin

  • Make sure your process for updating intrusion rules complies with your security policies.

  • Consider the update's effect on traffic flow and inspection due to bandwidth constraints and Snort restarts. We recommend performing updates in a maintenance window.

  • If the management center cannot access the Cisco Support & Download site, get the update yourself: https://www.cisco.com/go/firepower-software. Choose any management center model, then browse to the Coverage and Content Updates page.

Procedure

Step 1

Choose System (system gear icon) > Content Updates > Rule Updates.

Step 2

Under One-Time Rule Update/Rules Import, choose how you want to update intrusion rules.

  • Direct download: Choose Download new rule update....

  • Manual upload: Choose Rule update or text rule file..., then click Choose File and browse to the intrusion rule update.

Step 3

(Optional) Check Reapply all policies... to deploy after the update.

Step 4

Click Import.

Monitor update progress in the Message Center. Even if the Message Center shows no progress for several minutes or indicates that the update has failed, do not restart the update. Instead, contact Cisco TAC.

Step 5

Verify update success.

The rule update page shows the current version.

What to do next

If you did not deploy as a part of the update, deploy now.