While operating this mode, the IPS will compare the traffic with a set of rules and try to verify if the traffic matches the rule. This is very useful when you need to deploy a new rule to block an attempt to exploit a vulnerability. NIPS systems, such as Snort, are able to block threats by leveraging rule-based detection. For example, the Snort rule Sid 1-42329 is able to detect the Win.Trojan.Doublepulsar variant.
Snort rules are located under etc/snort/rules and you can download other rules from https://www.snort.org/downloads/#rule-downloads. When the Blue Team is going through an exercise with the Red Team, chances are that new rules must be created according to the traffic pattern and the attempts that the Red Team ...
