37-10
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 37 Configuring Virtual Sensors
Deleting A Virtual Sensor
–
Chapter 39, “Configuring Event Action Rules”
–
Configuring Anomaly Detection, page 40-6
All other policies are configured on the parent device, and the configurations apply to all virtual sensors
configured on the device.
Deleting A Virtual Sensor
Virtual sensors appear in the device selector in Device view. However, you cannot delete them from the
selector using the same command used for other devices. Instead, you must delete the virtual sensor from
the Virtual Sensors policy of the parent device, that is, the device on which the virtual sensor is defined.
The following procedure explains how to delete a user-defined virtual sensor.
Tip The base virtual sensor, vs0, does not appear in the device selector. Instead, it is represented by the parent
IPS sensor; it is considered to be the base IPS device. To delete the base vs0 sensor, you delete the entire
device from the inventory. For information on deleting devices from the inventory, see Deleting Devices
from the Security Manager Inventory, page3-55.
Before You Begin
When you delete a virtual sensor, you also delete the policies defined for the sensor, such as signature,
event action, and anomaly detection policies. If you configured non-default local policies, and you want
to preserve them for use on other virtual sensors, you must first convert the local policies to shared
policies. Then, after you delete the virtual sensor, the policies continue to exist as unassigned shared
policies. You can then assign them to another virtual sensor. For more information on creating a shared
policy from a local policy, see Sharing a Local Policy, page 5-38.
Using this technique is ideal if you are deleting a virtual sensor simply as a means to change the virtual
sensor’s name. Because you cannot change a virtual sensor’s name, you must delete it and create a new
virtual sensor with the desired name. If you created shared policies, you could then assign those shared
policies to your new sensor, and it will have the same configuration as the sensor had under the old name.
Step 1 (Device view only.) Select Virtual Sensors from the Policies selector to open the Virtual Sensors policy.
Step 2 Select the user-defined virtual sensor that you want to delete and click the Delete Row button.
Step 3 You are asked for a two-step confirmation. First, you are warned that you must save the policy to keep
the policy and device synchronized. Click OK to continue, and you are also asked to confirm that you
want to delete the node.
If you confirm, the virtual sensor is removed from both the policy and the device selector. It will take a
few moments before the device view is updated and the virtual sensor disappears from the list of devices.