According to CISCO doc, the signatures can be classified as exploit, connection and string-based.Are the exploit signatures based on known vulnerabilities or exploit pattern, or both?After tuning alerts on the relevant contexts, would manually matchi...