Hey all!
I need your help with the following,
I'm trying to get this condition to work:
If not (message: '^.dstintf="aaaa".' OR message: '^.dstintf="bbb".')
AND NOT (message: '^.action="ccc".' AND message: '^.action="dddd".' AND message: '^.action="eeee".')
For some reason, I'm having a hard time getting the right way.
I tried doing something like this:
- if:
equals:
type: "xxxxx"
then:
- drop_event:
when:
not:
or:
- regexp:
message: '^.*dstintf=\"aaaa\".*'
- regexp:
message: '^.*dstintf=\"bbbb\".*'
- and:
- regexp:
message: '^.*action=\"cccc\".*'
- regexp:
message: '^.*action=\"dddd\".*'
- regexp:
message: '^.*action=\"eeee\".*'
- regexp:
message: '^.*action=\"ffff\".*'