Responders must understand the limitations and capabilities of custom rules.

They can be used to monitor or block specific command-line strings.

A Custom IOA rule group can only be applied to one single prevention policy.

They can generate ' Informational ' detections if set to the ' Monitor ' action.

They allow for pattern matching using wildcards or specific strings.