Cisco
Login
Search
Software Secure Firewall Threat Defense
Platform Secure Firewall Threat Defense Virtual
Activity Onboard

Intrusion Detection and Prevention Get Started with Snort 3 Intrusion Policies Create a Custom Snort 3 Intrusion Policy

Last updated: Jul 29, 2025

Create a Custom Snort 3 Intrusion Policy

Procedure

1

Choose Policies > Intrusion.
2

Click Create Policy.
3

Enter a unique Name and, optionally, a Description.
4

Choose the Inspection Mode.

The selected action determines whether intrusion rules block and alert (Prevention mode) or only alert (Detection mode).


 

Before selecting the prevention mode, you might want block rules to alert only so you can identify rules that cause a lot of false positives.
5

Choose the Base Policy.

You can use either a system-provided policy or an existing policy as your base policy.
6

Click Save.

The new policy has the same settings as its base policy.

What to do next

To customize the policy, see Edit Snort 3 Intrusion Policies.

Previous topic Prerequisites for Network Analysis and Intrusion Policies Next topic Edit Snort 3 Intrusion Policies