> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Creating Egress Rule from DCF Logs

> Create a Distributed Cloud Firewall egress rule from monitor logs

You can create Egress rules based on the log information on the Security >
Distributed Cloud Firewall > Monitor tab.

<Note>
  If you create a rule this way, you do not have to create SmartGroups or
  WebGroups ahead of time. A SmartGroup and a WebGroup will be created for you
  as part of creating the Egress rule.
</Note>

1. Go to Security > Distributed Cloud Firewall > Monitor.
2. Select one or more logs.
3. From the Actions menu, click **Create Egress Rule**.
4. In the Create Egress Rule dialog, configure the following:

| Field | Description |
| - | - |
| Name | Distributed Cloud Firewall rule name. |
| Source SmartGroup | Create a SmartGroup(s) based on the selected logs. The Source SmartGroup automatically selects the VPC/VNet from the logs. Both the Source SmartGroup and WebGroup serve as the source with the destination being the Internet. The Destination is always Public Internet. |
| SmartGroup Name | Name the SmartGroup being created. |
| WebGroup | Create a WebGroup based on the selected logs. The WebGroup automatically selects the Domain from the logs. Both the Source SmartGroup and WebGroup serve as the source with the destination being the Internet. |
| WebGroup Name | Name the WebGroup being created. |
| Protocol | Select TCP, UDP, ICMP, or Any. If you select TCP or UDP you can enter a port number or port range. <Note>The ICMP protocol is unavailable if a WebGroup is selected, because WebGroups are only supported for TLS traffic.</Note> |
| Ports | Select the port that corresponds to the selected protocol. |
| Action | This determines the action to be taken on the traffic. <ul><li>Permit: Enforcement On</li><li>Deny: Enforcement On</li><li>Watch: Enforcement Off and Logging On</li></ul> |
| Logging | If this slider is On, information related to the action (such as five-tuple, source/destination MAC address, etc.) is logged. After the rule is created you can enable or disable logging from the vertical ellipsis menu next to the rule. <Note>Aviatrix recommends not logging Permit rules.</Note> |
| Intrusion Detection (IDS) | If Intrusion Detection is enabled, traffic is inspected for threats, and the results are displayed on the Detected Intrusions tab. |
| Place Rule | Select Above, Below, Top, Bottom, or Priority. |
| Existing Rule Name | If you select Above or Below (Place Rule), you must select the existing rule that is affected by the position of the new rule. |
| Priority | Enter a priority number for the new rule. If an existing rule already has that priority, it is bumped down in the list. Zero (0) is the highest priority number. You can change the rule priority after the rule is created (using the arrow icon next to that rule in the Rule table). |

## Related Topics

* [Creating DCF Egress Rules](/docs/cloud/security/dcf/dcf-create-rules)
* [Edit a DCF Rule](/docs/cloud/security/dcf/dcf-rule-edit)
* [Delete a DCF Rule](/docs/cloud/security/dcf/dcf-rule-delete)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.