The latest AnyConnect Client version 4.9.0.02028 (anyconnect-macos-4.9.02028) fixed the problem for me. You should give it a try.

I see. If using CSM, you should create different shared policies for DMZs and all other IPS in general. Another common practices is to configured different virtual sensors or simply different signature policies for these exceptions. Hope it helps.Sam

Not supported. But I wonder why you need to use Flexconfigs for IPS Signature tuning when it is supported natively?

I ran into the same problem.  You must copy the iso image into datastore first and run the image from there to work.