"Pre Import Configuration .. No Import Editor" syntax

[efanti]

Hi

I'm searching to work with "Pre Import Configuration .. No Import
Editor".

I read :

Syntax
* One entry per line
* Case insensitive matching
* Entries are matched against the payload, signature name and
signature category name

Syntax Example
{insensitive text match}
badsignature
another_bad:signature
not liking this signature either

I tried with:

SCAN UPnP service discover attempt

1917

But this events are always imported in aanval..

Where mistake ?

Thank you

enrico