CSA Rule Exception issue

Question

Is it possible when creating an exception with the Rule Wizard to not have it create a new rule module every time a rule is created.
I would like to just add rules to an Exceptions policy that is applied to the group with out it creating a new rule module every time.

Answer 1

Hi Adam
Yes, it says that in the user guide and I experienced the same thing when doing it.
Part of the user guide seems a bit confusing to me though.
The 1st statement on page 10-22 in the CSA 5.2 User guide is correct:
You can create a new rule module (an "exception rule module") which
would contain the new exception rule. (This is the default and recommended choice.)
The 2nd statement is (I feel) incorrect:
"This new module would be attached to a new exception policy which is then
attached to the group(s) containing the host from which the event was received."
I've done this several times and have yet to see it create an separate exception policy
And the 3rd statement is correct:
"If you choose to create this exception module, all subsequent exception rules you
create through the wizard will be added to the same exception module and policy
if the group it is to be applied to is also the same. Therefore, a group could only
have one exception policy, but contain an exception rule module with any number
of exception allow rules created through the wizard."
Tom