Forum Discussion
Yoann_Le_Corvi1
Jan 23, 2020Cumulonimbus
Hi
The short answer is (unfortunately) : it depends ! :)
It depends how strict you want to be on the policy, and how much time you have available for the job.
Always : once policy is stabilized, wildcard is removed any parameter not in the list will be blocked.
Selective : wilcard remains, paramters are allowed, but if you have to relax a setting (e.g. disable an attack signature) this will be applied only to the relevant parameter and not to all of them
Never : wildcard remain, and if you relax a setting (e.g. disable an attack signature) this will be applied to the wildcard, i.e. all parameters.
So no real "rule" unfortunately.
Hope this helps in the reflexion ?
Yoann