rule update in System Updates

[Ditter]

Hi to all,

curious about rules updates in update submenu of FMC.

What is this really for?

I can understand the product updates, geolocation updates etc

but what is the use of rules update especially from the support site?

please see attached snapshot.

thanks,

Ditter.

[tvotna]

This is about Intrusion Rules, aka Snort signatures.

[Ditter]

thanks from the name it wasn't very clear to me.

[Marvin Rhoads · Accepted solution]

Rules include what are known as Snort Rule Updates (SRU packages) as well as Local Security Packages (LSPs). Those update the Snort rulebase for Snort 2 and Snort 3 respectively. As @tvotna implied, they are the basis for your intrusion policy or policies.