Custom Snort 3 Intrusion Policies for Access Control

Recommended rules

Updated: February 4, 2026

Want to summarize with AI?

Describes the Secure Firewall recommended rules and explains how to generate and apply these rules to enhance security policy effectiveness.

This section provides an insight into Secure Firewall recommended rules and generating and applying Secure Firewall recommended rules.

Snort 3 rule changes in LSP updates

Snort 3 rule changes in LSP updates are modifications to system-defined intrusion rules that

replace existing rules with new rules for better detection capabilities,
combine multiple rules into a single rule or expand a single rule into multiple rules when better detection is possible, and
remove existing system-defined rules for better management as part of the LSP update.

To get notifications for changes to any overridden system-defined rules during LSP updates, ensure that the Retain user overrides for deleted Snort 3 rules check box is checked.

To navigate to the Retain user overrides for deleted Snort 3 rules check box, click System ( system gear icon ) > Configuration > Intrusion Policy Preferences.

By default this check box is checked. When this check box is checked, the system retains the rule overrides in the new replacement rules that are added as a part of the LSP update. The notifications are shown in the Tasks tab under the Notifications icon that is located next to System ( system gear icon ).

Secure Firewall recommended rules

Secure Firewall recommended rules are intrusion rule recommendations that

target vulnerabilities associated with host assets detected in the network, such as operating systems, servers, and client application protocols,
allow you to tailor your intrusion policy to the specific needs of your monitored network, and
provide individual recommendations for each intrusion policy. These typically apply to standard text rules and shared object rules, but recommendations can also include inspector and decoder rules.

Rule recommendation configuration options

When you generate rule state recommendations, you can use the default settings or configure advanced settings. Advanced settings allow you to:

Redefine which hosts on your network the system monitors for vulnerabilities
Influence which rules the system recommends based on rule overhead
Specify whether to generate recommendations to disable rules

You can also choose to use the recommendations immediately or review the recommendations (and affected rules) before accepting them.

Choosing to use recommended rule states adds a read-only Secure Firewall Recommendations layer to your intrusion policy, and subsequently choosing not to use recommended rule states removes the layer.

You can schedule a task to generate recommendations automatically based on the most recently saved configuration settings in your intrusion policy.

The system does not change rule states that you set manually such as:

Manually setting the states of specified rules before you generate recommendations prevents the system from modifying the states of those rules in the future.
Manually setting the states of specified rules after you generate recommendations overrides the recommended states of those rules.

Tip

The intrusion policy report can include a list of rules with rule states that differ from the recommended state.

While displaying the recommendation-filtered Rules page, or after accessing the Rules page directly from the navigation panel or the Policy Information page, you can manually set rule states, sort rules, and take any of the other actions available on the Rules page, such as suppressing rules, setting rule thresholds, and so on.

Note

The Cisco Talos Intelligence Group (Talos) determines the appropriate state of each rule in the system-provided policies. If you use a system-provided policy as your base policy, and you allow the system to set your rules to the Secure Firewall recommended rule state, the rules in your intrusion policy match the settings recommended for your network assets.

Generate new Secure Firewall recommendations in Snort 3

Generate Secure Firewall recommendations to create new recommended rule settings in Snort 3.

Generate the Secure Firewall recommendations for the intrusion policy and then follow the steps that are listed here to create new recommended rule settings in Snort 3. Rule overheads are interpreted as security levels based on the threshold policies you select in Snort 3. The recommended action depends on the selected security level. If it is higher than the base policy, the recommendation includes actions beyond only generating events.

Prior to setting the Secure Firewall recommendations you should ask which of the three points listed below closely matches the goal:

Increased Protection —Enable additional rules based on vulnerabilities found in the host database and do not automatically disable any rules. This will likely result in a larger rule set.
Focused Protection—Enable additional rules and disable existing rules based on vulnerabilities found in the host database. This can increase or decrease the number of rules depending on vulnerabilities discovered.
Higher Efficiency—Use the currently enabled rule set and disable any rules for vulnerabilities not found in the host database. This will likely result in a smaller enabled rule set.

Based on the response, these are the recommended actions:

Set recommendations to the next highest security level, and clear the option to disable rules.
Set recommendations to the next highest security level, and select the option to disable rules.
Set recommendations to the current security level, and select the option to disable rules.

Before you begin

Secure Firewall recommendations have the following requirements:

Ensure that hosts are present in the system to generate recommendations.
Protected networks configured for recommendations should map to the hosts present in the system

Follow these steps to generate new Secure Firewall recommendations in Snort 3:

Procedure

	1.	Choose Policies > Access Control heading > Intrusion.
	2.	Click the Snort 3 Version button of the intrusion policy.
	3.	Click the Recommendations (Not in Use) layer to configure the rule recommendations. Click Start. In the Secure Firewall Rule Recommendations window you can set the following: Security Level: Click to select the security level. Optionally, you can check the Accept Recommendation to Disable Rules checkbox to disable rules that are not enabled at the input security level and in protected networks. Only enable this option if you need to trim your rule set due to a high number of alerts or to improve inspection performance. The security levels are: Security level 1: Connectivity Over Security No Impact—No new rules are enabled and no existing rules are disabled. To increase the protection, select a higher security level. Lower Security (checkbox is checked)—All rules are disabled except for the rules in the Connectivity Over Security ruleset that match potential vulnerabilities on discovered hosts. It is recommended instead to adjust the Base Policy. Security level 2: Balanced Security Over Connectivity No Impact—No new rules are enabled and no existing rules are disabled. To increase the protection, select a higher security level. Higher Efficiency(checkbox is checked)—Keeps existing rules that match potential vulnerabilities on discovered hosts and disables rules for vulnerabilities not found on the network. Security level 3: Security Over Connectivity Increased Security—Enables additional rules that match potential vulnerabilities on discovered hosts based on the Maximum Detection ruleset. Focused Security(checkbox is checked)—Enables additional rules that match vulnerabilities on discovered hosts based on the Security Over Connectivity ruleset, while disabling existing rules that do not match potential vulnerabilities on discovered hosts. Security level 4 : Maximum Detection Increased Security—Enables additional rules that match potential vulnerabilities on discovered hosts based on the Security Over Connectivity ruleset. Focused Security (checkbox is checked)—Enables additional rules that match vulnerabilities on discovered hosts based on the Maximum Detection ruleset, while disabling existing rules that do not match potential vulnerabilities on discovered hosts. Note Maximum Detection enables a very high number of rules and may impact performance. We recommend you to review and test this setting before deploying into a production environment. Protected Networks: Specifies the monitored networks or individual hosts to examine for recommendations. You can select one or more system or custom defined network objects from the drop-down list. By default, any IPv4 or IPv6 networks are selected, if no selection is done. The Secure Firewall Rule Recommendations depend on network discovery. Protected Networks apply to any hosts discovered within the ranges configured in your Network Discovery policy. For more information, see the chapter Network Discovery Policies in the Cisco Secure Firewall Management Center Device Configuration guide. Click the Add + button to create a new network object of type Host or Network and click Save.
	4.	Generate and apply recommendations: Generate: Generates the recommendations for an intrusion policy. This action lists the rules under Recommended Rules (Not in use). Generate and Apply: Generates and applies the recommendations for an intrusion policy. This action lists the rules under Recommended Rules (In use). Recommendations are generated successfully. A new recommendation tab appears with all the recommended rules with their corresponding recommended actions. Rule action preset filters are also available for this tab, in addition with new recommendations.
	5.	You can verify the recommendations and choose to apply them. Accept—Applies the previously generated recommendations for an Intrusion policy. Refresh—Regenerates and updates the rule recommendations for an Intrusion policy. Edit—It opens the Recommendations dialog box, you can provide the recommendation input values and then generate the recommendations. Remove All—Revert or remove the applied recommended rules from the policy and also removes the recommendation tab. Under All Rules, there is a Recommended Rules section which displays the recommended rules. Note Final action for an Intrusion rule is applied based on the rule action priority order and following is the rule action priority order: Rule Override > Generated Recommendations > Group Override > Base Policy Default Action For enabled recommendations, Firewall Management Center considers the current state: group overrides, base policy, and recommendation configurations and priority order of actions is: pass > block > reject > drop > rewrite > alert

What to do next

Deploy configuration changes. See Deploy configuration changes.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.