21-20
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 21 Rules
Working with System and User Inspection Rules
Figure 21-6
User Inspection Rule Wizard Form
The following numbers correspond to the numbers shown in
Figure 21-6
.
1.
Check the boxes next to the items in the
Sources Selected
field to select them, and click the
Toggle
Equal
button to change them between equal and not equal.
2.
Click the
Select All
button to select all items in the
Sources Selected
field. Items selected in the
Sources Selected field are deselected when you click
Select All
.
3.
Use the
Equal
and
Not Equal
buttons to bring highlighted items from the
Sources Available
field
into the
Sources Selected
field.
4.
Filter sources from this drop-down list.
5.
Enter search text, and click
Enter
to move items that match the search criteria from the
Sources
Available
field to the
Sources Selected
field.
6.
To add a new item to the sources, click the
Add
button. To edit or delete an existing source, click
the
Edit
or
Delete
button.
7.
Click an item or items in the Sources Selected field, and use the
Remove
button.
8.
To move IP values up into the Sources Selected field, click the
Equal
up icon, or the
Not Equal
up icon.
9.
Check the radio button next to
IP
or
Range
, and enter an IP address or a range of IP addresses into
their respective fields.
10.
Select items in the Sources Selected field by clicking them. Enter a group name, and click the
Grouped As
button to group them.
Step 5
Follow the wizard, and select the values for the rule, clicking the
Next
button to progress to the next step.
Step 6
When you are asked, “Are you done defining the rule conditions,” you can:
–
Click the
Yes
button for a single line rule. Continue to add repetition requirements (counts),
alert information, and valid time ranges for each line.
143412
1
2
5
4
7
6
8
9
10
3
