Setting intrusion rule states

Set intrusion rule states to determine how rules respond to detected intrusions within your security policy.

Intrusion rule states are policy-specific and control whether rules generate events, drop traffic, or remain disabled.

Before you begin

Follow these steps to set intrusion rule states:

Step 1

Choose Policies > Security policies > Intrusion.

Step 2

Click Snort 2 Version next to the policy you want to edit.

If View ( View button ) appears instead, the configuration belongs to an ancestor domain, or you do not have permission to modify the configuration.

Tip	This window indicates the total number of enabled rules, the total number of enabled rules set to Generate Events, and the total number set to Drop and Generate Events. In a passive deployment, rules set to Drop and Generate Events only generate events.

Step 3

Click Rules immediately under Policy Information in the navigation panel.

Step 4

Choose the rule or rules where you want to set the rule state.

Step 5

Choose one of the following:

Step 6

To save changes you made in this policy since the last policy commit, click Policy Information in the navigation panel, then click Commit Changes.

If you leave the policy without committing changes, changes since the last commit will be discarded if you edit a different policy.