Cisco
Login
Search
Software Secure Firewall Threat Defense
Platform Secure Firewall Threat Defense Virtual
Activity Onboard

Network Discovery Application Detection Custom Application Detectors Configuring Custom Application Detectors

Last updated: Jul 29, 2025

Configuring Custom Application Detectors

You can configure basic or advanced custom application detectors.

Procedure

1

Select Policies > Application Detectors.

2

Click Create Custom Detector.

3

Enter a Name and a Description.

4

Choose an Application Protocol from the application drop-down list. You have the following options:

  • If you are creating a detector for an existing application protocol (for example, if you want to detect a particular application protocol on a non-standard port), select the application protocol from the drop-down list.

  • If you are creating a detector for a user-defined application, follow the procedure outlined in Create a User-Defined Application.

5

Click Detector Type as Basic or Advanced.
6

Click OK.

7

Configure Detection Patterns or Detection Criteria or Encrypted Visibility Engine Process Assignments:

  • If you are configuring a basic detector, specify preset Detection Patterns as described in Specifying Detection Patterns in Basic Detectors.

  • If you are configuring an advanced detector, specify custom Detection Criteria as described in Specifying Detection Criteria in Advanced Detectors.

  • If you are configuring an encrypted visibility engine (EVE) detector, specify custom EVE process assignments as described in Specifying EVE Process Assignments section in this chapter.


     

    Advanced custom detectors are complex and require outside knowledge to construct valid .lua files. Incorrectly configured detectors could have a negative impact on performance or detection capability.

8

Optionally, use Packet Captures to test the new detector as described in Testing a Custom Application Protocol Detector.

9

Click Save.


 

If you include the application in an access control rule, the detector is automatically activated and cannot be deactivated while in use.

What to do next

Previous topic Custom Application Detector and User-Defined Application Fields Next topic Create a User-Defined Application