topic Re: Need help with a rule.. in Network Security

Need help with a rule..

mmorris11 — Sun, 10 Mar 2019 10:31:00 GMT

I wrote a rule with the intent of it firing upon events originating only from public ip addresses AND only for yellow OR red severity levels. However this rule still fires on green severity events. Can any one see why from looking at the rule in the attached graphic?

Thank you,

Mike

Re: Need help with a rule..

edwakim — Tue, 20 Mar 2007 03:29:40 GMT

Hi Mike,

I hope you are doing fine.

I guess you are talking about MARS here.

Could you please attach the graphic?

Thank you.

Edward

Re: Need help with a rule..

mmorris11 — Tue, 20 Mar 2007 13:31:31 GMT

Edward,

Glad I checked this! Actually what happened is that posted this before attaching and discovered that you can't attach after the fact. The full post is here: http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1ddde4e8

Check out this TAC case (this is about something else): SR 605613157 - CSMARS-rule building

It led to an enhancement request: CSCsi17878 - Rules should have 'NOT-FOLLOWED-BY' operator

-mike