According to CISCO doc, the signatures can be classified as exploit, connection and string-based.
Are the exploit signatures based on known vulnerabilities or exploit pattern, or both?
After tuning alerts on the relevant contexts, would manually matching the patterns in payload and signature provide more confidence with positives?
