I've seen mixed configurations where someone will explicitly create an inspection rule using an intrusion policy and then other cases where someone has created an inspection rule only for files (no intrusion policy) but then configures the intrusion ...