Stef Morrell
2014-05-09 10:22:52 UTC
Hi all,
I've been looking into an issue with scan.messages.rules which comes down to it being an all match rule, rather than a first match rule - but there are several rulesets which work on the all match basis.
Is there any harm that can be done in moving such rulesets from [All,YesNo] into [First,YesNo] within ConfigDefs.pl if the first match behaviour is more useful in any given case (and for me, especially with scan.messages.rules).
Stef
I've been looking into an issue with scan.messages.rules which comes down to it being an all match rule, rather than a first match rule - but there are several rulesets which work on the all match basis.
Is there any harm that can be done in moving such rulesets from [All,YesNo] into [First,YesNo] within ConfigDefs.pl if the first match behaviour is more useful in any given case (and for me, especially with scan.messages.rules).
Stef