Here are two sample custom conditions:
[{
"field": "alert_severity_id",
"operator": "in",
"value": [1, 2]
},
{
"field": "alert_title",
"operator": "like",
"value": "phishing"
}]
[{
"field": "severity.severity_name",
"operator": "like",
"value": "Critical"
}]
Copy one of these conditions and paste it into the "Custom Conditions" field above, then adjust the values as needed.