21
©
SOLIDA SYSTEMS INTERNATIONAL
2016
6.5 Operating Mode
When trialing a new rule set, it is possible to set the appliance to “monitor mode”. The rule set
page contains a drop down menu where the desired operating mode can be selected. In monitor
mode all network packets are scanned using the rules as well as the reputation detection lists, but
no packets will be dropped. Alerts will still be generated the same way as in normal operation
mode. This allows the user to check a new rule set to make sure it behaves as expected. Once the
user is satisfied with the new rule set, set the operating mode back to “Normal Mode”
6.6 Creating Custom Rules
It is beyond this manual to explain in detail how to write custom rules. Please refer to the many
tutorials and documentation available on the Internet on how to write detection rules.
A rule is created using the configuration application. Start the application and navigate to the
“Rule List” page. This page will display a list of all rules currently available in the appliance.
At the top left side of this page a blue button labeled “+ Add rule” is located. To create a new
custom rule, simply click this button. A new window will pop up called “Create Custom Rule”.
Figure 6.3 Create a custom rule pop-up window.
This window contains five tabs. Each tab contains different optional rule parameters. These
parameters can be filled in to define the new rules behavior. For a detailed description of each
