topic Hello Chinguun, in Network Security

Firepower intrusion rule

chinguun bayar — Tue, 12 Mar 2019 13:04:36 GMT

Hi there.

i really confused with my intrusion policy block below signature.

I dont know what is 1 instances of http - drop

Hi,

ankojha — Fri, 15 Jul 2016 06:05:33 GMT

Hi,

If you click on this 1 instance of http , you will be able to see the rule action which is changed to drop.

Rate if it helps.

Thanks,

Ankita

Keep in mind, your My Layers

Ed Padilla Jr — Fri, 15 Jul 2016 18:04:09 GMT

Keep in mind, your My Layers overrides the other rules states from. Once you check the rule, you have three options: Alert/Generate events, Drop, or Disable. If you see two red arrows, the one on the left is set to DROP, and the red arrow on the right is Firesight RECOMMENDED rules to activate.

Happy tuning

Hello Chinguun,

Jetsy Mathew — Fri, 15 Jul 2016 19:12:17 GMT

Hello Chinguun,

Adding to what the other experts said , here is the quick reference link which may help you further in understanding more about intrusion rules.

http://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/Intrusion-Rule-Writing.html

Whenever you need to understand more about any option in Firesight GUI, Please click on Online help option on the right top handside of the Web interface.

Rate if that helps you

Regards

Jetsy