Duplicating Rules

This topic describes how to duplicate the content of an existing rule.

Duplicating a rule is recommended if you want to make changes to some of the read-only System rule fields. When clicking the Duplicate hyperlink, if the System rule was Active, you will be asked whether or not to Inactivate the original rule before making a copy of it. If you opt to Inactivate the original rule, the newly-copied rule will remain Active.

To duplicate an alert or prevent rule

1. In the list of rules in the Alert & Prevent Rules page (Configuration > Alerts > Alert & Prevent Rules), select the rule you want to duplicate. See Viewing Rules.

   You can only duplicate one rule at a time.

2. Open the More Actions drop-down menu above the list of rules, and click the Duplicate hyperlink.

   

   The Edit Alert/Prevent Rule page opens with a new alert rule initialized to the exact content of the selected item, named "Copy of <selected rule name>".

3. You can edit the rule, if and as required. For details, see the relevant topics:

• Defining Rule Details

• Configuring a Detection Policy for Alert Rules

• Configuring a Detection Policy for Linux Prevention Rules

• Defining Actions for Alert Rules

• Configuring the Prevent Execution Action

Click Save to save your settings.