Overview

Explains how to create custom rules, manage allowed lists, and classify rogue devices based on risk.

About the allowed list workflow

Introduces the allowed list workflow in Catalyst Center, enabling administrators to move specific rogue AP MAC addresses to an allowed list in bulk. Outlines supported rogue types, such as Rogue on Wire and Honeypot, while identifying threat categories that are excluded from this functionality.

Set up the allowed list workflow

Details the workflow for managing allowed rogue APs in Catalyst Center, including bulk CSV uploads and individual MAC address management. Explains the necessary administrative permissions, file validation requirements, and how to update threat categories to ensure accurate network security monitoring.

About custom rogue rule creation

It looks like you've captured the essence of custom rogue rules in Catalyst Center. This summary effectively highlights how these rules help administrators minimize noise and tailor threat management to their specific organizational needs.

Edit a rogue rule

Provides instructions for editing existing rogue rules in Catalyst Center, including modifying rule conditions and managing auto-containment settings. Explains that configuration changes apply only to new data and highlights specific constraints for enabling automatic containment for Honeypot and high-level threats.

Delete a rogue rule

Provides instructions for deleting rogue rules in Catalyst Center, noting that predefined rules like Honeypot cannot be removed. Explains that deleting the last rule in a profile removes the entire profile and allows you to view previously deleted items under the Inactive tab.

Create a custom rogue rule

Provides instructions for creating custom rogue rules in Catalyst Centerby defining specific threat conditions and associating them with rule profiles. Details how to configure threat levels, enable auto-containment for high-level threats, and manage rule priorities to effectively classify and mitigate network security risks.

About rogue rule profiles

Introduces rogue rule profiles in Catalyst Center, which allow you to group and prioritize specific rogue rules for site-based threat management. Explains how rule profiles are inherited through the network hierarchy and how direct floor-level assignments take precedence over inherited parent-site configurations.

Edit a rogue rule profile

Guides you through editing rogue rule profiles in Catalyst Center, including managing rule associations and auto-containment settings. Explains that configuration updates apply only to new data and notes that the predefined Honeypot rule is automatically included in all new profiles for consistent threat management.

Delete a rogue rule profile

Provides instructions for deleting rogue rule profiles in Catalyst Center. Explains how to navigate to the Rogue Rule Profiles tab to select and remove specific profiles from the system.

Create a rogue rule profile

Details the process of creating a rogue rule profile in Catalyst Center, including adding specific rules, setting their priority, and associating the profile with a site. Explains how to configure auto-containment settings and verify the final configuration to ensure effective threat management across your network.

View the allowed access points list

Guides you through accessing and managing the Allowed Access Points list in Catalyst Center. Explains how to view MAC addresses, search or filter specific entries, export the list to CSV, and add or remove access points to maintain accurate threat detection.

About the allowed vendor list

Introduces the Allowed Vendor List feature, which enables you to reclassify threats from specific vendors as Potential or Informational rather than High. Explains that you can add up to five vendors per workflow and that site-specific vendor rules take precedence over inherited configurations.

View vendor rule list information

Provides instructions for viewing the list of created vendor rules in Catalyst Center. Details how to navigate to the Allowed Vendor List table to review vendor names, match criteria, assigned threat levels, associated site information, and the last update timestamp.

Edit a vendor rule

Details the procedure for editing existing vendor rules in Catalyst Center, including modifying vendor names, match criteria, threat levels, and associated sites. Explains how to save these changes to ensure your allowed vendor configurations remain current and aligned with your network security requirements.

Delete a vendor rule

Provides instructions for deleting vendor rules in Catalyst Center. Explains how to navigate to the Allowed Vendor List tab to select and remove specific vendor rules from your network security configuration.

Create a list of allowed vendors

Provides instructions for creating an allowed vendor list in Catalyst Center, allowing you to reclassify vendor threats as Potential or Informational. Details how to define selection criteria, add up to five vendors per workflow, and apply these rules to specific sites within your network hierarchy.