When I have an event logged that I need to allow is it best practice to clone only the offending rule module and change the rules in that module as needed or should I also clone the policy and then clone the rules?This is new rollout just so you know...

I just started a new job and the company I work for wanted to implement the devices they purchased from Cisco for the "Self Defending Network". I have several years experience with Cisco gear and started with the CSA. The problem I am having is tha...