Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Deleting rule in MARS

How do you delete an inspection rule in MARS

1 REPLY
Silver

Re: Deleting rule in MARS

Hi Lewis,

The inspection rules cannot be deleted. They can only be made inactive.

The original reasoning was that if you were doing some forensic investigation and a rule was no longer on the system then the database would be corrupt.

You are not the first person to ask for this and I believe Cisco is considering this feature request.

In the meantime, when you need to make a change to a rule just clone the original and then make the original inactive. In this way if you make a mistake you can make this rule inactive. You can then clone the original rule again and fine tune what you are trying to accomplish.

Hope this helps.

Paul

130
Views
0
Helpful
1
Replies
CreatePlease to create content