Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Silver

CSA 6.0.1 Rules Which Have Been Removed But Still Trigger Alerts

What is the rational behind rules which have been removed but still trigger events?

What is the Best Practice we should follow with them? Suppress?

We are talking about Rule 732 from the default configuration. It triggered an event for an application we later Whitelisted. Subsequently, we deleted the rule and now we still see the notices in our Events Log.

Anyone have an idea on a workaround?

Thank you in advance.

1 REPLY
Silver

Re: CSA 6.0.1 Rules Which Have Been Removed But Still Trigger Al

I am thinking it is this bug:

CSCsm64761

File Access Control rule triggers incorrectly

Symptom:

User notices that a File Access Control rule triggers unexpectedly as the

file mentioned in the event was not supposed to be targeted by that rule.

144
Views
0
Helpful
1
Replies
CreatePlease to create content