Filter
Top Products
39-9
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 39 Configuring Event Action Rules
Configuring Event Action Filters
Filter Item Dialog Box
Use the Add or Edit Filter Item dialog box to configure an event action filter rule.
Tip For existing rules, you can edit most of these fields directly from the event actions filter rules table by
right-clicking the cell and selecting the appropriate command from the top portion of the context menu.
For example, you can right click the Attacker Ports cell and select Edit Attacker Ports. Many of these
right-click commands open a version of the Edit Filter Item dialog box that contains only the selected
property. When seeking help for these context-editing dialog boxes, look for the property description in
the table below.
Navigation Path
From the Event Action Filters page (see Event Action Filters Page, page 39-7), click the Add Row
button, or select a filter rule and click the Edit Row button.
Related Topics
• Configuring Event Action Filters, page 39-4
• Tips for Managing Event Action Filter Rules, page 39-6
Up Row and Down Row
buttons (arrow icons)
Click these buttons to move the selected rules up or down within a
scope.
Filter rules are processed in order top to bottom for each event. If the
conditions of an event match those defined for a filter, and the filter has
the Stop field set to Yes, that filter is applied and no additional filters
are considered. Ensure that stop rules are placed after the other rules
you want applied to an event.
You should order the more restrictive rules before general rules in the
table.
Add Row button Click this button to add a filter rule to the table after the selected row
using the Add Filter Item dialog box (see Filter Item Dialog Box,
page 39-9). If you do not select a row, the rule is added at the end of the
local scope.
Edit Row button Click this button to edit the selected rule. You can also edit individual
cells by right-clicking the cell and selecting the appropriate Edit
command.
Delete Row button Click this button to delete the selected rule.
Tip Instead of removing the rule, you can right-click the rule and
select Disable. This prevents the rule from being used, but
leaves it in the table in case you want to use it again at a later
time.
Table 39-2 Event Action Filters Page (Continued)
Element Description