"Add to This Rule" versus "Add to Exiting rule"

cancel
Showing results for 
Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

"Add to This Rule" versus "Add to Exiting rule"

L1 Bithead

Hi Guys,

 

I tried to find out what is the difference between  "Add to This Rule" versus "Add to Exiting rule" in a security policy.

 

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

@cmartin_60,

Assuming that you're talking about policy optimization on the "Apps Seen" tab, it means what you would expect. The Add to This Rule option will add the app specified to the rule that captured the traffic initially, while the Add to Existing Rule will add the application into a different entry that already exists in your rulebase.

As an example, if you have any sort of "catch-all" rule present to identify traffic, you'd likely never want to "Add to This Rule" since it would completely break the purpose of the rule; instead you would either "Add to Existing Rule" (say if you want to add it to some sort of "allowed applications" rule or something like that), or you would "Create Cloned Rule" to create a new entry and not break the "catch-all" entry. 

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

@cmartin_60,

Assuming that you're talking about policy optimization on the "Apps Seen" tab, it means what you would expect. The Add to This Rule option will add the app specified to the rule that captured the traffic initially, while the Add to Existing Rule will add the application into a different entry that already exists in your rulebase.

As an example, if you have any sort of "catch-all" rule present to identify traffic, you'd likely never want to "Add to This Rule" since it would completely break the purpose of the rule; instead you would either "Add to Existing Rule" (say if you want to add it to some sort of "allowed applications" rule or something like that), or you would "Create Cloned Rule" to create a new entry and not break the "catch-all" entry. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!