21-32
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 21 Rules
Rule and Report Groups
Step 3
Click
Delete Group
.
The Delete Report Group dialog box appears listing the reports in the group to delete. You are prompted
to verify deletion.
Step 4
Click
Yes.
The report group no longer appears in the report group dropdown lists on the Report and Query pages.
Display Incidents Related to a Rule Group
To display incidents that occur from the firing of rules in a specific rule group, follow these steps:
Step 1
Navigate to the Incidents page.
Step 2
Select the rule group in the dropdown filter above the Matched Rules column, as shown in
Figure 21-16
.
The Incidents page will display only those incidents that occurred from rules firing in the selected rule
group.
Figure 21-16
Rule Group on Incidents Page
