---
title: "Expert Rule Properties page"
slug: "expert-rule-properties-page"
tags: ["Reference", "ENS 10.7.x"]
updated: 2026-10-06T19:45:35Z
published: 2026-10-06T19:45:35Z
canonical: "docs.trellix.com/expert-rule-properties-page"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Expert Rule Properties page

Create an Expert Rule.

 
 

| **Section** | Option | Definition |
| --- | --- | --- |
| **Rules** | **Signature ID** | Indicates the assigned ID number for the signature. |
| **Rule name** | Specifies or indicates the name of the rule. |
|  | **Severity** | Specifies the severity level for the rule. - **Informational** - **Low** - **Medium** - **High** |
|  | **Action** | Specifies the action for the rule. - **Block** — Blocks behavior that matches the signature without logging. - **Report** — Logs behavior that matches the signature without blocking. To disable the signature, deselect **Block** and **Report**. |
|  | **Rule type** | Specifies the rule type and, if **Use Expert Rule template** is enabled, adds the appropriate template to the **Rule content** pane. Select the rule type from the drop-down list. - **Buffer Overflow** - **Files** - **Illegal API Use** - **Processes** - **Registry key** - **Registry value** - **Services** You can't create Network IPS Expert Rules. |
|  | **Use Expert Rule template** | Specifies to populate the **Rule content** field with a template for the selected **Rule type**. (Enabled by default) Deselect this option to select a new type from the **Rule type** drop-down list. |
|  | **Rule content** | Specifies the content of the rule. Change the code to specify objects to protect or exclude. |
|  | **Notes** | Provides more information about the item. |