Cisco
Login
Search
Software Secure Firewall Threat Defense
Platform Secure Firewall Threat Defense Virtual
Activity Onboard

Intrusion Detection and Prevention Custom Intrusion Rules Rule Anatomy The Intrusion Rule Header

Last updated: Jul 29, 2025

The Intrusion Rule Header

Every standard text rule and shared object rule has a rule header containing parameters and arguments. The following illustrates parts of a rule header:

Diagram illustrating the parts of a rule header: Type, Protocol, Source IP, Source Port, Operator, Destination, and Destination Port.

The following table describes each part of the rule header shown above.

Table 1. Rule Header Values

Rule Header Component

Example Value

This Value...

Action

alert

Generates an intrusion event when triggered.

Protocol

tcp

Tests TCP traffic only.

Source IP Address

$EXTERNAL_NET

Tests traffic coming from any host that is not on your internal network.

Source Ports

any

Tests traffic coming from any port on the originating host.

Operator

->

Tests external traffic (destined for the web servers on your network).

Destination IP Address

$HTTP_SERVERS

Tests traffic to be delivered to any host specified as a web server on your internal network.

Destination Ports

$HTTP_PORTS

Tests traffic delivered to an HTTP port on your internal network.


 

The previous example uses default variables, as do most intrusion rules.

Previous topic Rule Anatomy Next topic Intrusion Rule Header Action