In the rule header section, you define the following:
- Action the Sensor needs to take when it sees the attack traffic
- Transport layer protocol of the attack traffic
- Source and destination IP for the attack traffic
- Communication port at both the source and destination of the attack
- Direction of the traffic that the Sensor should inspect
The items listed above are discussed in detail in the subsequent sections.