You can create custom threat signatures to detect
and block very specific traffic. The following resources will help
you get started:
Creating Custom Threat Signatures from Snort
Signatures—This tech note provides guidance on how to create
custom signatures, by demonstrating how to create one based on a Snort
signature (Snort is a free and open source IPS).
Creating Custom Threat and Application Signatures—Walks
through custom signature examples, and describes how to use regex
and contexts to create custom signatures (with details on each available context).
