Custom vulnerability object trigger

[M.Bathgate]

Trying to use a custom vulnerability object to raise a threat alert when a user directly enters a request for access to an IPv4 address . eg http://12.34.56.78  .  Ive created a object , with a pattern of (.*((?:\d{1,3}\.){3}\d{1,3})) and applied it to a vulnerability profile that is applied to a bunch of rules .   I can see the rules triggered but the vulnerability is not logging as a threat , ive also had the converse where a normal URL eg http://www.xyz.com is being flagged as a vulnerability as a false positive .    Anyone had success (consistently) with custom vulnerability objects using regex patterns ?    the field im using the regex pattern against is http-req-host-headers