topic MARS query - Save as rule in Network Security

MARS query - Save as rule

mmorris11 — Sun, 10 Mar 2019 10:16:15 GMT

Right now most of the rules I am creating are drop rules while doing the initial tuning of my MARS box. When I use the query to save as a rule, it apprears that you can only save it as an inspection rule and never as a drop rule. Am I missing something?

Re: MARS query - Save as rule

chrisd — Mon, 23 Oct 2006 13:01:57 GMT

No, that is the correct operation of the MARS appliance.

Drop rules are only configured on the rules tab.

Chris

ciscomars.blogspot.com

Re: MARS query - Save as rule

JUCETA — Tue, 24 Oct 2006 09:08:20 GMT

Hi,

That's a question in very relationship with another I've posted. I can create lots of inspection rules based on keywords but I can not create a drop rule based on that. P.e. There's a lot of logs originated in domain controllers that I'm able to classify them based on "User Name: Local-Admin" words and their source IP. I'm sure that's correct and I want to drop all events. It's not possible. I can only create an inpection rule, not a drop rule.

Thanks a lot.