Where can an analyst working with Offenses add a regular expression test into an existing rule?

{} [+]