Defining rules

A rule consists of the statements you define when you create the rule. You use key-value pairs and other command options to define the statements. The statements do the following:

Specify the position of the rule in the rule list, and delete duplicate rules.
Specify matching criteria to apply to alert objects. These statements are defined in access group rules.
Specify matching criteria to apply to login requests, and add optional comments. These statements are defined in authorization rules.

The system processes all of the rules in the defined sequence, instead of stopping when the first match is found. For access group rules, this allows the user access to all of the alerts that match the criteria in all rules defined for the user's access groups. For authorization rules, this allows the user to be added to multiple access groups and allows users who meet multiple match criteria to be added to the same access group.

Rule usage guidelines

Follow these guidelines when you define rules.

A rule can include multiple match options, but only one of each type. For example, a rule cannot have two match-ldap-group <group DN> options. There are two exceptions:
- The match-access-group <access group> match option, as described in grant-access-group <access group>.
- The match-alert-tag <tag name> match option, as described in match-alert-tag <tag name>.
If a rule includes more than one match option (an AND operation), both statements must be true to achieve a match.
For example, a rule that grants access to the "nx-alerts" access group has two statements. One statement specifies that the mapped local user name is anne and the other statement specifies that the user is a member of the infosec LDAP group. Anne has a local user account on the Central Management System appliance, but she is not a member of the "infosec" LDAP group, so she will not be added to the "nx-alerts" access group.
If you want to achieve a match if only one of a series of statements is true (an OR operation), you must create a separate rule for each statement.
For example, if the matching criteria in the previous example were specified in separate rules instead of as statements in one rule, both Anne and the members of the "infosec" LDAP group will be added to the "nx-alerts" access group.
If you remove all matching criteria statements from an authorization rule, all analyst and monitor users will be granted access to that access group and will be subject to the rules defined for it.
Do not use the match-not command option to remove a match criterion, even if that command option was used to add the match criterion. For example, use the no aaa authorization access-groups group nx-alerts rules rule 3 match-alert-severity command to remove a match criterion that was added using the match-not-alert-severity minor option.
Do not include the command option value to remove a match criterion. For example, in the previous item, minor is not included in the command that removes the alert severity match criterion.

Command options

The following tables describe the key-value pairs and other options you can use to define rules.

Rule operation options

You can use the following command options to define the position of a rule in the rule list, modify a rule, and delete duplicate rules.

Command option	Description
append tail	Inserts the new rule after the highest-numbered rule, or at position 1 if there are no existing rules.
insert <rule number>	Inserts the new rule at the specified position. If there is already a rule in this position, that rule and all other rules are moved up one position.
set <rule number>	Creates a new rule at the specified position. If there is already a rule in this position, it is replaced by the new rule.
modify <rule number>	Creates or modifies a rule at the specified position. If there is already a rule in this position, the old values for an existing match option are retained unless they are modified by new values for that match option.
dup-delete	Delete rules that are the same as the specified rule. (Rules that are the same except for their comments are not deleted.)

Access group rule options

You can use the following command options to define the criteria used to match alerts the Central Management System appliance receives from managed Network Security appliances, Email Security — Server appliances, and Email Security - Cloud instances. Users in the access group specified in the rule can view and manage the alerts that meet the match criteria.

Command option	Description
match-alert-tag <tag name>	Match the specified restricted tag. (The tag must already be created and designated as "restricted" using the Central Management System Web UI. See the Central Management System Administration Guide for details.) To match multiple tags, add a separate `match-alert-tag <tag name>` option for each tag.
match-not-alert-tag <tag name>	Do not match the specified "restricted" tag.
match-appliance-name <appliance name>	Match the specified managed Network Security or Email Security — Server appliance name. Use the `show cmc appliances` command on the Central Management System appliance to view the appliance names.
match-not-appliance-name <appliance name>	Do not match the specified managed appliance name.
match-alert-severity <severity>	Match the specified severity level (critical, major, or minor).
match-not-alert-severity <severity>	Do not match the specified severity level.
match-alert-source-ip <network prefix>/<mask>	Match the specified source address.
match-not-alert-source-ip <network prefix>/<mask>	Do not match the specified source address.
match-alert-target-ip <network prefix>/<mask>	Match the specified target address.
match-not-alert-target-ip <network prefix>/<mask>	Do not match the specified target address.
match-all-alerts	Match all alerts from all managed Network Security appliances, Email Security — Server appliances, and Email Security - Cloud instances.
match-full-ui-access	Provide unrestricted UI access.
match-yara-rules-access	Match YARA rules modification and deletion access for users in the Network Security appliance.

Authorization rule options

You can use the following command options to define the criteria used to match users logging into the Central Management System Web UI. Users whose login requests meet the match criteria are granted access to the access group specified in the rule.

Command option	Description
match-auth-method <method>	Match the specified authentication method (local, radius, tacacs+, or ldap).
match-not-auth-method <method>	Do not match the specified authentication method.
match-remote-username <name>	Match the specified remote user name.
match-not-remote-username <name>	Do not match the specified remote user name.
match-mapped-local-username <name>	Match the specified local user name.
match-not-mapped-local-username <name>	Do not match the specified local user name.
match-ldap-group <group DN>	Match the specified LDAP group Distinguished Name (DN).
match-not-ldap-group <group DN>	Do not match the specified LDAP group DN.
match-ldap-search-filter <string>	Match the specified LDAP search filter.
match-x509-cert-subject <string>	Match the specified subject field in the client X.509 certificate. The subject field contains the Distinguished Name (DN).
match-x509-cert-san-email <string>	Match the specified email address in the Subject Alternate Name (SAN) field in the X.509 client certificate.
match-x509-cert-san-email-username <string>	Match the specified user name portion of the email address in the X.509 client certificate.
match-x509-cert-san-upn <string>	Match the specified User Principal Name (UPN) attribute from the SAN/Other Name field in the X.509 client certificate.
match-x509-cert-san-upn-username <string>	Match the user name from the UPN attribute in the X.509 client certificate.
match-x509-cert-subject-cn <string>	Match the specified Common Name (CN) entry from the DN attribute in the X.509 client certificate.
match-oidc-preferred-username <string>	Match the specified preferred-username field in the OIDC identity token.
match-oidc-email <string>	Match the specified email field in the OIDC identity token.
match-oidc-email-username <string>	Match the specified username portion of the email address in the OIDC identity token.
grant-access-group <access group>	Grant the user who matches the criteria in the rule access to the specified access group or groups. To apply the rule to multiple access groups, you can do one of the following: Add a separate `grant-access-group <access group>` option for each group. Use one `grant-access-group <access group>` option with a comma-separated list of groups as the `<access group>` parameter.
comment "<comment>"	Add an optional comment to the rule. Enclose the comment in double quotation marks if it includes more than one word.