Create the signature for packet grep protocol match

After you create the attack definition, you create the signature for the attack.

1. In the New Custom Attack window, click Signature-<signature name> tab.

   
   
   

2. (Optional) Clear the Name and type a new name for your signature.
3. For this example, you can leave the Benign Trigger Probability (BTP), Target Host Architecture, and Detection Window with the default values.
4. Based on the Sensor model that you plan to use for this example, select the Supported Device Types.
5. Add the condition to the signature.
   It is in the conditions that you specify the following details:
   • The string that the Sensor should look for
   • Which section of the HTTP request should it look for the string
6. Proceed to add the condition.