How to write custom IPS signatures for blocking applications?

Hello Vineeth Penugonda,

Thank you for reaching out to the community, you can refer the following useful KBAs:
1.) Custom IPS signatures: https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/IntrusionPrevention/CustomIPSSignatures/index.html
2.) Add a custom IPS signature: https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/tasks/IpsCustomSignatureEdit.html

Hello Vineeth Penugonda,

Thank you for reaching out to the community, you can refer the following useful KBAs:
1.) Custom IPS signatures: https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/IntrusionPrevention/CustomIPSSignatures/index.html
2.) Add a custom IPS signature: https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/tasks/IpsCustomSignatureEdit.html

Thanks for the Custom IPS signature syntax link. Is there any tutorial for making a custom IPS signature for an "example application"? I am confused what to put in "content, rawbytes, offset, uricontent, byte_test" keywords.