Steps to add the condition to the example signature:
Click Condition 1 so that it is highlighted.
Click AND.
The Add AND Comparision dialog opens.
Numeric Enumeration Match.png "GUID-FB8458AD-613C-450A-BD18-4AE8B4EB59D4-low.png")
For this example, select Numeric Enumeration Match in the Comparison Type drop-down menu.
Select http from the Protocol list.
Because you selected HTTP, the Custom Attack Editor displays the HTTP-specific protocol fields on the following screen.
Configure the fields for the comparison you have chosen.
For this example, specify rsp-code for the Protocol Field. This specifies that the Sensor should search in the URI of the request packet.
In the New Integer field, enter the in the numeric value.
Click Add.
You can add multiple values in the New Integer field. For this example enter 302 and 404.
Click Save.
Your comparison appears under Condition 1.
Click Add in the New Custom Attack window.
Verify that the attack definition is listed on the All Custom Attacks tab.
.png)
Click Save to save the Trellix IPS Custom Attack in the Manager server database.
Make sure the Trellix IPS Custom Attack is saved in the database and also published in the policies.