Add attack descriptions to the Attack Encyclopedia

You can enter Attack Descriptions and comments in the Attack Encyclopedia for custom attacks. Attack Description can be added at the time of creating a custom attack. Comments can be added after creating the custom attack. When an alert is raised for a custom attack, these details can be viewed from the Attack Log as well

This procedure on adding comments assumes that you have a Trellix IPS or a Snort Custom Attack published.

Steps:

Select Policy → <Admin Domain Name> → Intrusion Prevention → Policy Types → IPS.
The IPS page is displayed. The Default Testing policy listed in the IPS page contains all the custom attacks (both Trellix IPS and Snort) that have been published.
Double-click on the Default Testing policy.
All the Attacks Definitions under the Default Testing policy are listed under the Attacks Definitions tab.
Search for the custom attack for which you want to add attack descriptions by entering the name of the attack in the Quick Search box
Note
All Trellix IPS custom attacks are prefixed "UDS" and all Snort attacks are prefixed "Snort".
Double-click on the custom attack that you have located.
The attack details pane for the selected attack is displayed.
Click Description to view the details of the custom attack from the attack encyclopedia.
Enter the comment for the Attack in the Comment for this Admin Domain field.
Click Save Comment.