The following is the high-level recommended approach for creating Trellix IPS custom attacks.
Steps:
Be clear on what you are trying to achieve through these attacks. Identify the related protocols, applications, hardware and software platforms, and so on for the attack.
Understand the mechanics of a Trellix IPS custom attack. You also need to understand the probable impact of your custom attack on the network.
Take a quick tour of the Custom Attack Editor and get familiar with it. You can use the Custom Attack Editor to manage the custom attacks.
Create a Trellix IPS custom attack with one or more signatures.
Verify if the attack is published in the policies.
Push the attack with its signatures to the Sensors for attack detection to happen.