Deleting rule in MARS

Unanswered Question
Mar 19th, 2009

How do you delete an inspection rule in MARS

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
pmccubbin Thu, 03/19/2009 - 15:43

Hi Lewis,

The inspection rules cannot be deleted. They can only be made inactive.

The original reasoning was that if you were doing some forensic investigation and a rule was no longer on the system then the database would be corrupt.

You are not the first person to ask for this and I believe Cisco is considering this feature request.

In the meantime, when you need to make a change to a rule just clone the original and then make the original inactive. In this way if you make a mistake you can make this rule inactive. You can then clone the original rule again and fine tune what you are trying to accomplish.

Hope this helps.



This Discussion