CSA 4.5.1.639 Warnings

[kerraj2004]

how to stop the logging on the WARNINGS in CSAMC. Warnings do not have a wizard to create an exception to stop logging and I dont want to change the rule so do I need to copy the rule and uncheck logging, and if so, is it ok to have a copy of the same rule in the same group??

Thx

[b.hsu]

When the wizard completes, it takes you to the new behavior analysis configuration page as it appears in CSA MC. You can edit it at this time or you can deploy the analysis by doing the following:

Generate rule programs to distribute the behavior analysis to the host.

Wait for the logging process to stop or click the Stop logging button to force the stop.

http://www.cisco.com/en/US/products/sw/secursw/ps5057/products_configuration_guide_chapter09186a0080424781.html