I believe the patterns should go in /Database/var/register/system/net/L7/l7-protocols/(your directory here). There’s extra, malware, testing, etc… in here, pick the appropriate one. The /Database is important in the beginning, as the /Database directory keeps everything on a reboot. If put in just /var/… it will be gone on reboot.
run “service l7 restart” to restart the service and to be accessible in the gui