Firepower intrusion rule

[chinguun bayar]

Hi there. 

i really confused with my intrusion policy block below signature.

I dont know what is 1 instances of http - drop

[ankojha]

Hi,

If you click on this 1 instance of http , you will be able to see the rule action which is changed to drop.

Rate if it helps.

Thanks,

Ankita

[Ed Padilla Jr]

Keep in mind, your My Layers overrides the other rules states from.  Once you check the rule, you have three options: Alert/Generate events, Drop, or Disable.   If you see two red arrows, the one on the left is set to DROP, and the red arrow on the right is Firesight RECOMMENDED rules to activate.  

Happy tuning

[Jetsy Mathew]

Hello Chinguun,

Adding to what the other experts said , here is the quick reference link which may help you further in understanding more about intrusion rules.

http://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/Intrusion-Rule-Writing.html

Whenever you need to understand more about any option in Firesight GUI, Please click on Online help option on the right top handside of the Web interface.

Rate if that helps you

Regards

Jetsy