Trellix IPS provides a simple but powerful set of logical constructs that will allow you to create an attack definition to match the fingerprint of nearly any network activity. The logical constructs provide methods for grouping and ordering the more granular pieces of the signature - numeric tests and pattern matches - in any order you require. The core constructs are:
AND - Tests are grouped within AND blocks. The tests must all succeed, but may occur in any order inside the context of a given flow. AND blocks cannot be contained within an OR condition.
OR - The first test to succeed fulfills the condition, and the next AND or OR block is engaged. OR constructs are contained within AND blocks, though at times they may be the only contents.
ANDTHEN - ANDTHEN is the ordering construct. By placing ANDTHEN statements between AND blocks, you can create a structured order for your tests, if required.
The actual tests of which signatures are composed are placed inside either AND or OR constructs. These are called conditions and are like containers. ANDTHEN is used to link the AND containers (conditions) together to form a larger structure.