Cisco Security Agent

CSA Rule Modules

Rule modules group rules or sets of rules that serve a similar purpose. After you group the rules, you can apply the rule module where necessary to specific policies. The CSA product includes several rule modules that serve functional purposes, but you can also create additional rule modules that apply to your specific environment and user base.

The CSA architecture provides two types of rules for application: enforcement and detection. Enforcement rules either allow or deny actions from occurring. Detection rules monitor rules that do not enforce compliance or rules that tag processes to application classes and do not take enforcement actions themselves.

Working with Rule Modules

The CSA MC separates rule modules into two groups: ...