The following example shows the complete process you follow to configure a new access group and its associated rules.
cm-04 (config) # aaa authorization access-groups group nx-east description "eastern region NX alerts"cm-04 (config) # aaa authorization access-groups group nx-east rules rule append tail match-not-alert-severity minor match-alert-tag malware-object comment "major and critical malware-object alerts"cm-04 (config) # aaa authorization access-groups group nx-east rules rule append tail match-alert-source-ip 172.1.2.0/24cm-04 (config) # aaa authorization access-groups rules rule append tail match-ldap-group intel-hq grant-access-group nx-eastcm-04 (config) # aaa authorization access-groups rules rule append tail match-ldap-group intel-east grant-access-group nx-eastcm-04 (config) # aaa authorization access-groups area alerts enable Type 'YES' to confirm enabling access groups that limit access to certain objects like alerts for non-admin users: YES
cm-04 (config) # show aaa authorization access-groups group nx-east AAA Authorization Access-groups Rules : Enabled --------------------------------------------------------------- # Group: nx-east Description : eastern region NX alerts --------------------------------------------------------------- # Rule Statements --------------------------------------------------------------- #1 Comment: major and critical malware-object alerts Match Alert Tag: malware-object Not Match Alert Severity: minor #2 Match Alert Source IP: 172.1.2.0/24 cm-04 (config) # show aaa authorization access-groups rules --------------------------------------------------------------- # AAA Authorization Access-groups Rules : Enabled --------------------------------------------------------------- # Rule Statements --------------------------------------------------------------- #1 Match LDAP Group : intel Grant Access Groups : nx-east #2 Match LDAP Group : intel-east Grant Access Groups : nx-east