In the rule header section, you define the following:
Action the Sensor needs to take when it sees the attack traffic
Transport layer protocol of the attack traffic
Source and destination IP for the attack traffic
Communication port at both the source and destination of the attack
Direction of the traffic that the Sensor should inspect
The items listed above are discussed in detail in the subsequent sections.