Custom Attacks or Custom Attack Definitions are user-defined attack definitions. You create such definitions to supplement the attack definitions (Signature Set) that Trellix provides.
Custom Attack Editor enables you to create Trellix Custom Attacks as well as Snort Custom Attacks. Using this tool, you can also import custom attacks in bulk against defining them individually. You use the Custom Attack Editor to manage custom attacks. You can launch it from the Custom Attacks page of the Manager. From the Manager, select Policy → <Root Admin Domain> → Intrusion Prevention → Policy Types → IPS. Click Custom Attacks.
For more information, see Create custom attacks.