|
|
| How do you edit a rule's priority? |
|
|
We''re using Activeworx Security Center and I'm trying to edit some rules in IDSPM to change the rule priority from a 1 to a 2. The Priority field is greyed out. I'm using the latest standalone beta.
I have an ASC rule to email me on High Priority alerts and some of the ones with a priority of 1 are not high in our environment.
Thanks,
Ray
|
|
|
|
 | |
|
|
| Re: How do you edit a rule's priority? |
|
|
Priorities are set by the classification. If you change it in the Classification, it will be changed in the Rule. If you don't want all rules to be changed, you can create a new classification.
Cheers,
Jeff |
|
|
|
| |
|
|
| Re: How do you edit a rule's priority? |
|
|
Looking into this a little more.. You can also set the priority for an individual rule by applying the following to the rule options:
priority:2;
This will override what is set in the classification.
Cheers,
Jeff |
|
|
|
| |
|
|
| Re: How do you edit a rule's priority? |
|
|
Jeff wrote
Looking into this a little more.. You can also set the priority for an individual rule by applying the following to the rule options:
priority:2;
This will override what is set in the classification.
Cheers,
Jeff |
Thanks, I'll try that. It looks like the delimiter between different options is the : character. Is that correct? I think that means I must change the trailing ; to a : and then add in the priority syntax above.
Hmmm, I clicked Add Reference to add a note as to what I did and OK'ed it. What I added got deleted because I did not select anything in the little Type dropdown to the left. After I selected a Type, it got saved. Can you add a "Note" type to the drop-down that it will default to if someone forgets to enter a Type, or pop up a warnign that no Type was selected rather than silently deleting the text?
Ray
|
|
|
|
| |
|
|
| Re: How do you edit a rule's priority? |
|
|
| Thanks, I'll try that. It looks like the delimiter between different options is the : character. Is that correct? I think that means I must change the trailing ; to a : and then add in the priority syntax above. |
Well, that comment about the delimiter certainly was wrong. :-)
Thanks for the View Log feature. The last line told me it failed to restart because of the syntax error.
What's the purpose of the Column dropdown on the Update Server Policies dialog box? I also cannot ever get the Fast update to work. Selecting it and clicking Start does nothing at all.
Ray
|
|
|
|
| |
|
|
| Re: How do you edit a rule's priority? |
|
|
rpesek wrote
Hmmm, I clicked Add Reference to add a note as to what I did and OK'ed it. What I added got deleted because I did not select anything in the little Type dropdown to the left. After I selected a Type, it got saved. Can you add a "Note" type to the drop-down that it will default to if someone forgets to enter a Type, or pop up a warnign that no Type was selected rather than silently deleting the text?
|
It is really not that it deletes text, it just doesn't add invalid references. I will create a popup to let the user know the reference was invalid and will be removed if they continue.
Thanks again for the feedback.
Cheers,
Jeff |
|
|
|
| |
|
|
| Re: How do you edit a rule's priority? |
|
|
rpesek wrote
What's the purpose of the Column dropdown on the Update Server Policies dialog box? I also cannot ever get the Fast update to work. Selecting it and clicking Start does nothing at all.
|
The purpose of this dropdown is to change the column that will be checked when select,unselect, etc... menu items are clicked.
Cheers,
Jeff |
|
|
|
| |
|
|
| Re: How do you edit a rule's priority? |
|
|
Ahhh, the buttons to its right. Got it.
Thanks,
Ray |
|
|
|
| |
|
|
| Re: How do you edit a rule's priority? |
|
|
rpesek wrote
Hmmm, I clicked Add Reference to add a note as to what I did and OK'ed it. What I added got deleted because I did not select anything in the little Type dropdown to the left. After I selected a Type, it got saved. Can you add a "Note" type to the drop-down that it will default to if someone forgets to enter a Type, or pop up a warnign that no Type was selected rather than silently deleting the text?
|
A new feature was added in IDSPM v2.1 final that prompts the user if they would like to continue if the references are invalid. Thanks for this feedback!
IDSPM v2.1 final is in the download section now for registered users and generally available to all tomorrow.
Cheers,
Jeff
|
|
|
|