Expert Rule Properties page

Create an Expert Rule.

Option definitions
Section	Option	Definition
Rules	Signature ID	Indicates the assigned ID number for the signature.
Rules	Rule name	Specifies or indicates the name of the rule.
	Severity	Specifies the severity level for the rule. Informational Low Medium High
	Action	Specifies the action for the rule. Block — Blocks behavior that matches the signature without logging. Report — Logs behavior that matches the signature without blocking. To disable the signature, deselect Block and Report.
	Rule type	Specifies the rule type and, if Use Expert Rule template is enabled, adds the appropriate template to the Rule content pane. Select the rule type from the drop-down list. Buffer Overflow Files Illegal API Use Processes Registry key Registry value Services You can't create Network IPS Expert Rules.
	Use Expert Rule template	Specifies to populate the Rule content field with a template for the selected Rule type. (Enabled by default) Deselect this option to select a new type from the Rule type drop-down list.
	Rule content	Specifies the content of the rule. Change the code to specify objects to protect or exclude.
	Notes	Provides more information about the item.