A scanner announces itself with BadBot in its requests, and no built-in rule knows it. Write a rule, and try it safely: detection mode reports what a rule would do without dropping anything, so you can see whether it would break real traffic before you trust it.
The simulator ticks each one as soon as the network meets it.
On the Intrusion screen, add this rule: alert tcp any any -> any 80 (msg:"Bad bot"; content:"badbot"; nocase; sid:1000001; rev:1;)
Create IPS policy BOT-WATCH (base connectivity, mode detection), attach it to rule HTTP-WEB, and set rule 1000001 to drop in that policy. A custom rule starts disabled in every policy.
Deploy. On LAP1: traffic tcp 203.0.113.10 80 payload "User-Agent: BadBot/2" still arrives, and Intrusion events says it would drop.
Change the policy to prevention and deploy. The same packet is now dropped.
