topic Re: rule update in System Updates in Network Security

rule update in System Updates

Ditter — Tue, 30 Jan 2024 13:54:38 GMT

Hi to all,

curious about rules updates in update submenu of FMC.

What is this really for?

I can understand the product updates, geolocation updates etc

but what is the use of rules update especially from the support site?

please see attached snapshot.

thanks,

Ditter.

Re: rule update in System Updates

tvotna — Tue, 30 Jan 2024 14:00:34 GMT

This is about Intrusion Rules, aka Snort signatures.

Re: rule update in System Updates

Ditter — Tue, 30 Jan 2024 14:40:18 GMT

thanks from the name it wasn't very clear to me.

Re: rule update in System Updates

Marvin Rhoads — Wed, 31 Jan 2024 03:35:11 GMT

Rules include what are known as Snort Rule Updates (SRU packages) as well as Local Security Packages (LSPs). Those update the Snort rulebase for Snort 2 and Snort 3 respectively. As @tvotna implied, they are the basis for your intrusion policy or policies.