Cisco
Login
Search
Software Secure Firewall Threat Defense
Platform Secure Firewall Threat Defense Virtual
Activity Onboard

Intrusion Detection and Prevention Custom Intrusion Rules Custom Rule Creation Writing New Rules

Last updated: Jul 29, 2025

Writing New Rules

Procedure

1

Choose Objects > Intrusion Rules.

2

Click Create Rule.

3

Enter a value in the Message field.

4

Choose a value from each of the following drop-down lists:

  • Classification
  • Action
  • Protocol
  • Direction
5

Enter values in the following fields:

  • Source IPs
  • Destination IPs
  • Source Port
  • Destination Port

The system uses the value any if you do not specify a value for these fields.

6

Choose a value from the Detection Options drop-down list.

7

Click Add Option.

8

Enter any arguments for the keyword you added.

9

Optionally, repeat steps 6 to 8.

10

If you added multiple keywords, you can:

  • Reorder keywords — Click the up or down arrow next to the keyword you want to move.
  • Delete a keyword — Click the X next to that keyword.
11

Click Save As New.

What to do next

  • Enable your new or changed rules within the appropriate intrusion policy.

  • Deploy configuration changes.

Previous topic Custom Rule Creation Next topic Modifying Existing Rules