cancel
Showing results for 
Search instead for 
Did you mean: 
kcmusa
Level 7

rules and use of action (stop cycle, stop rule set...)

Jump to solution

lets say I have a rule set based on IP.

so if you are this ip this happens, then

if this IP this happens and so on.

if I match the first rule do I stop the rule set or stop the cycle?

0 Kudos
1 Solution

Accepted Solutions
asabban
Level 17

Re: rules and use of action (stop cycle, stop rule set...)

Jump to solution

Hello,

in case the three rules are within one single rule set "Stop Rule Set" is the right action. The first matching rule will be executed, all others won't do anything. If one rule with "Stop Rule Set" matched, the remaining rules within this rule set are skipped.

Please note that "Stop Rule Set" will stop the processing of further rules within the rule set where you have called it + all child rule sets.

Best,

Andre

0 Kudos
3 Replies
McAfee Employee

Re: rules and use of action (stop cycle, stop rule set...)

Jump to solution

Hi KC!

Sorry, the wording isnt very clear. Could you clarify further if this is a ruleset or a single rule?

If it was a ruleset, you cannot apply an action. You can only apply an action in the rules within the ruleset.

-Continue = Continue processing rules

-Block = Stop everything and block the request/response/embedded

-Stop Ruleset = Stop processing the rules in the given ruleset

-Stop Cycle = Stop processing all rules in the given cycle (request/response/embedded)

Best,

Jon

Follow Up Tomorrow -- ABENJAMI
0 Kudos
kcmusa
Level 7

Re: rules and use of action (stop cycle, stop rule set...)

Jump to solution

I made a top level rule that does nothing, and within that have 3 rules that do an action base on your IP.

So If the first one matches what is the action to stop processing the other 2 rules? but if it does not match, It should continue checking the next rule....

not sure of the terminology of rule set, hope this helps.

0 Kudos
asabban
Level 17

Re: rules and use of action (stop cycle, stop rule set...)

Jump to solution

Hello,

in case the three rules are within one single rule set "Stop Rule Set" is the right action. The first matching rule will be executed, all others won't do anything. If one rule with "Stop Rule Set" matched, the remaining rules within this rule set are skipped.

Please note that "Stop Rule Set" will stop the processing of further rules within the rule set where you have called it + all child rule sets.

Best,

Andre

0 Kudos