aaa authorization access-groups rules rule

Creates or modifies an authorization rule defining matching criteria that is applied to a login request, and specifies the access group to which the matched user will be granted access.

Note

For more information about authorization rules and usage, see the "Configuring Access Groups for Alerts" chapter of the Trellix System Security Guide.

Syntax

aaa authorization access-groups rules rule <operation> <match option 1> [<match option 2>...] grant-access-group <access group name> [comment "<comment>"]

no aaa authorization access-groups rules rule <rule number> <match option>

no aaa authorization access-groups rules rule <rule number>

no aaa authorization access-groups rules all

no aaa authorization access-groups rules rule <rule number> comment

Parameters

no

The no forms of this command remove the specified match option, the specified authorization rule, all authorization rules, or a comment from an authorization rule.

operation

The operation used to define the position of a rule in the rule list, modify a rule, or delete duplicate rules.

match option

The match criteria that will be applied to login requests. You can include multiple match options, but not more than one of the same type. If a rule includes more than one match option, all statements must be true to achieve a match.

access group

The name of the access group to which the rule applies. To apply the rule to multiple access groups, you can add a separate grant-access-group <access group> option for each group, or use one option with a comma-separated list of groups as the <access group> parameter.

comment

An optional comment. Enclose the comment in double-quotation marks if it includes more than one word.

Examples

The following example creates a rule that grants users in the infosec LDAP group access to the alerts defined for the nx-alerts access group.

cm-03 (config) # aaa authorization access-groups rules rule append tail match-ldap-group infosec grant-access-group nx-alerts

cm-03 (config) # show aaa authorization access-groups rules

#      AAA Authorization Access-groups Rules : Enabled
-----------------------------------------------------------
# Rule        Statements
-----------------------------------------------------------
 #1           Match LDAP Group          : infosec
              Grant Access Groups       : nx-alerts

The following example removes the match-mapped-local-username analyst2 match option from rule 2.

cm-05 (config) # no aaa authorization access-groups rules rule 2 match-mapped-local-username

The following example adds the user "analyst_a" to the "special-analysts" access group on the nx-03 appliance for YARA rules access.

nx-03 (config) # aaa authorization access-groups rules rule append tail grant-access-group special_analysts match-mapped-local-username analyst_a

nx-03 (config) # show aaa authorization access-groups rules

-------------------------------------------------------------- 
#         AAA Authorization Access-groups Rules : Enabled 
-------------------------------------------------------------- 
# Rule          Statements      
-------------------------------------------------------------- 

# 1
Match Map Local Users              : analyst_a
Grant Access Groups                : special_analysts
		

User role

Admin

Command mode

Configuration

Supported appliances

This command is supported on the following appliances running the specified releases or later: