Firesight rule update

[filterfilter]

Hi,

I have a question regarding rules update, from what i read in the manual, rule update will provide new/modified some base rules and settings.

is it possible to revert back to old rule update in case the new update have some impact to current network/app? or is there a way to track the changes they made on the base rules

Thanks

FF

[Dinesh Verma]

Hi,

I'm not sure if rollback to older rule update is possible but sure you can see what are the modified rules & new rules added in new-released-rule-update.

Go to Cisco website where rule updates are present & hove mouse over particular rule update. it pops up a little window which has hyperlink for Modified Rules & New Rules.

For eg, go to this URL -> All release -> Rule update & hove mouse over a rule update.

https://software.cisco.com/download/release.html?mdfid=286259687&softwareid=286271056&release=SEU&relind=AVAILABLE&rellifecycle=&reltype=latest

Take a look to the snapshot attached for clarification. Hope this helps.

Regards,

Dinesh Verma

[filterfilter]

Hi Dinesh,

Thanks , this definitely a help 

[Sunil Kumar]

You can track the rule update from the IPS policy which new/modified rules have been merged into the IPS policy and what is current status (Generate Events/ Drop & Generate Events/ Disable) of those rule. 

If New/Modified Rule are creating any issue in your network then you can disable those rule from here. Please have a look on image to get more info - 

Regards, 

Sunil Kumar

Rate if this helps !!

[filterfilter]

Hi Sunil,

Thanks for your input,  do you know if there is a way to export this rule update to csv?  

the only options i saw is to genereate a report (PDF) for the whole intrusion policy.

[Nadeem Jan]

please confirm if it help u reverting back to previous build of rules pack?

[jeruizru]

Hi Everyone,

Does anyone know in what format I need to upload new rules?

Kind Regards.