aaa authorization access-groups group ＜group name＞ rules rule

Creates or modifies an access group rule defining matching criteria that is applied to an alert object or YARA rule access.

Note
For more information about access group rules and usage, see the "Configuring Access Groups for Alerts" chapter of the Trellix System Security Guide.

Syntax

aaa authorization access-groups group <group name> rules rule <operation> <match option 1> [<match option 2>...]

no aaa authorization access-groups group <group name> rules rule <rule number> <match option>

no aaa authorization access-groups group <group name> rules rule <rule number>

no aaa authorization access-groups group <group name> rules all

Parameters

no

Use the no forms of this command to remove the specified match option, the specified access group rule, or all access group rules.

operation

The operations used to define the position of the rule in the rule list, modify a rule, and delete duplicate rules.

`append tail`	Inserts the new rule after the highest-numbered rule, or at position 1 if there are no existing rules.
`insert <rule number>`	Inserts the new rule at the specified position. If there is already a rule in this position, that rule and all other rules are moved up one position.
`set <rule number>`	Creates a new rule at the specified position. If there is already a rule in this position, it is replaced by the new rule.
`modify <rule number>`	Creates or modifies a rule at the specified position. If there is already a rule in this position, the old values are retained unless they are modified by new values specified by this command.
`dup-delete`	Deletes rules that are the same as the specified rule. (Rules that are the same except for their comments are not deleted.)

match option

The match criteria that will be applied to alert objects or YARA rules access. You can include multiple match options, but not more than one type (except for the match-alert-tag type). If a rule includes more than one match option, all statements must be true to achieve a match.

`match-alert-tag <tag name>`	Match the specified restricted tag. (The tag must already be created and designated as "restricted" using the Central Management System Web UI. See the Central Management System Administration Guide for details.) To match multiple tags, add a separate `match-alert-tag <tag name>` option for each tag.
`match-not-alert-tag <tag name>`	Do not match the specified "restricted" tag.
`match-appliance-name <appliance name>`	Match the specified managed Network Security or EX Series appliance name. Use the `show cmc appliances` command on the Central Management System appliance to view the appliance names.
`match-not-appliance-name <appliance name>`	Do not match the specified managed appliance name.
`match-alert-severity <severity>`	Match the specified severity level (critical, major, or minor).
`match-not-alert-severity <severity>`	Do not match the specified severity level.
`match-alert-source-ip <network prefix>/<mask>`	Match the specified source address.
`match-not-alert-source-ip <network prefix>/<mask>`	Do not match the specified source address.
`match-alert-target-ip <network prefix>/<mask>`	Match the specified target address.
`match-not-alert-target-ip <network prefix>/<mask>`	Do not match the specified target address.
`match-all-alerts`	Match all alerts from managed Network Security and EX Series appliances and managed Email Security - Cloud instances.
`match-full-ui-access`	Provide unrestricted UI access.
`match-yara-rules-access`	Match YARA rules modification and deletion access for users in the Network Security appliance

Examples

The following example creates a rule that grants users in the nx-alerts access group access to all major and critical alerts from the acme-nx2500 appliance.

cm-12 (config) # aaa authorization access-groups group nx-alerts rules rule append tail match appliance-name acme-nx2500 match-not-alert-severity minor

cm-12 (config) # show aaa authorization access-groups group nx-alerts

AAA Authorization Access-groups Rules : Enabled
-------------------------------------------------
# Group: nx-alerts
-------------------------------------------------
# Rule          Statements
-------------------------------------------------
 #1             Match Appliance Name: acme-nx2500
                Not Match Alert Severity: minor

The following example changes the alert tag to match in access group rule 3 to "malware_object."

cm-02 (config) # aaa authorization access-groups rules rule modify 3 match-alert-tag malware_object

The following example enables the access group "special-analysts" to modify and delete YARA rules.

nx-03 (config) # aaa authorization access-groups group special-analysts  rules rule append tail match-yara-rules-access

nx-03 (config) # show aaa authorization access-groups group special-analysts
			
AAA Authorization Access-groups Rules : Enabled 

------------------------------------------------ 
# Group: special-analysts                   
------------------------------------------------ 
# Rule         Statements      
------------------------------------------------ 
#1 
Match YARA rules access

User role

Admin

Command mode

Config

Supported appliances

This command is supported on the following appliances running the specified releases or later:

Central Management System: Release 8.2.0. New option was added to match against full UI access in Release 8.7.1.
Network Security: New option was added to match YARA rules access in Release 9.1.0.