Benefits of custom network analysis and intrusion policies

Custom network analysis and intrusion policies are security configurations that:

  • improve system performance in your specific environment,

  • provide a focused view of malicious traffic and policy violations occurring on your network, and

  • allow granular configuration of how the system processes and inspects network traffic for intrusions.

Custom policy structure

You may find that the inspector options, intrusion rules, and other advanced settings configured in the system-provided network analysis and intrusion policies do not fully address the security needs of your organization.

All custom policies have a base policy, also called a base layer, which defines the default settings for all configurations in the policy. A layer is a building block that you can use to efficiently manage multiple network analysis or intrusion policies.

In most cases, you base custom policies on system-provided policies, but you can use another custom policy. However, all custom policies have a system-provided policy as the eventual base in a policy chain. Because rule updates can modify system-provided policies, importing a rule update may affect you even if you are using a custom policy as your base. If a rule update affects your deployment, the web interface marks affected policies as out of date.