D
DioIPS

Creating Rules

IPS

How to create and manage IPS rules in the DioIPS application.

Creating a New Rule

  1. Navigate to the Rules tab
  2. Click the + New Rule button
  3. Fill in the rule details (see below)
  4. Click Save
  5. Rule is immediately active and synced to the kernel

Rule Fields

FieldRequiredDescription
NameYesDescriptive name for the rule
DescriptionNoOptional notes about the rule
Match TypeYesWhat to match (process, file, network, etc.)
PatternYesWildcard pattern to match against
ActionYesWhat to do when matched (Log, Alert, Block, Kill)
EnabledYesWhether the rule is active

Match Types

Process

Match by process name or path

File

Match by file path

Registry

Match by registry key path

Network IP

Match by IP address

Network Port

Match by port number

DNS

Match by domain name

Creating from Event

You can quickly create a rule from any event:

  1. Click on an event in any tab
  2. In the event details panel, click Create Rule
  3. The rule form opens pre-filled with event data
  4. Adjust the pattern and action as needed
  5. Click Save

Managing Rules

  • • Edit — Click the edit icon to modify a rule
  • • Delete — Click the delete icon to remove a rule
  • • Enable/Disable — Toggle the switch to enable or disable
  • • Reorder — Drag rules to change evaluation order
  • • Export — Export rules to JSON file
  • • Import — Import rules from JSON file

Rule Order

Rules are evaluated in order from top to bottom. The first matching rule's action is taken. Place more specific rules before general ones.

1. Block powershell.exe from Temp  ← More specific
2. Alert on all powershell.exe     ← More general
3. Log all processes               ← Catch-all