topic Re: Rule filtering on Specific SID's on Firepower device in Network Security

Rule filtering on Specific SID's on Firepower device

Scott112 — Fri, 21 Feb 2020 14:16:21 GMT

Hi,

I have multiple specific SID's that I specifically want to disable across multiple intrusion policies on a Cisco Firepower device as part of a tuning process. Unfortunately when entering the SID's with a , deliminintaor into the filter from the rules page via the Intrusion policy window is not producing any results. I have also tried filtering GID:SID, SID;, [SID]. When searching for a single SID I can obtain a result.

Is anyone aware of a way I can achieve this, I do not want to filter based on categories but multiple specific SID's. Do I need to use regex to deliminate? Thanks in advance.

Re: Rule filtering on Specific SID's on Firepower device

Austin Clark — Wed, 21 Feb 2018 17:22:09 GMT

Any updates on this????

It seems like any keywords entered are just stringed together with invisible 'and' statements. Basically can we use 'or' statements in the rule filter

Re: Rule filtering on Specific SID's on Firepower device

pazzi — Wed, 21 Feb 2018 19:19:44 GMT

Hi Austin, negative.

Search bar has an implicit AND to any/all keywords.