Delete an alert policy exception for an attack category that encompasses multiple alert rules or vulnerabilities.
Syntax
no policymgr signature category <attackCategory> [interface {<portPair> | ALL | MGMT} [src {<srcIP>/<prefix> | any} [ dst {<dstIP>/<prefix> | any}]]]
Parameters
<attackCategory>
Delete an exception for one of the following predefined attack categories:
Infection-Match—Alert rules that perform full or partial matching to identify a URL pointing to a Web infection.
Malware-Callback—Alert rules that identify callback events, which include signature matches and communications with a botnet server.
Riskware—Alert rules that identify files that are similar to malware but are not intended to be malicious.
IPS—All IPS alert rules.
Reconnaissance—IPS alert rules that detect reconnaissance activity (ping sweeps and port scans of ports, hosts, or networks) in progress and generate alerts when suspicious activity reaches a threshold.
Local-Signature—All custom alert rules, including custom IPS rules.
interface {<portPair> | ALL | MGMT}
The exception to be deleted applies to traffic through the specified appliance interface:
<portPair>—Traffic through the specified monitoring port pair. See the Hardware Administration Guide for your appliance.ALL—Traffic through all monitoring port pairs.MGMT—Traffic through the appliance management interface.
src {<srcIP>/<prefix> | any}
The exception to be deleted applies to traffic with the specified source.
<srcIP>/<prefix>—Traffic with the specified source IPv4 host or subnet, specified in CIDR format. Example: 10.128.45.154/32<any>—Traffic with any source IPv4 address.
dst {<dstIP>/<prefix> | any}
The exception to be deleted applies to traffic with the specified destination.
<dstIP>/<prefix>—Traffic with the specified destination IPv4 host or subnet, specified in CIDR format. Example: 172.217.27.36/32<any>—Traffic with any destination IPv4 address.
Example
This example deletes an alert policy exception for the alert rules specified by the IPS attack category. The exception being deleted applies to traffic through the appliance monitoring port pair A, with the 10.128.45.154/32 subnet source and the 172.217.27.36/32 subnet destination.
hostname (config) # no policymgr signature category IPS interface A src 10.128.45.154/32 dst 172.217.27.36/32
User role
Operator or Admin
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 9.0.2