Skip to content

Expand Condition Functionality #524

@gfs

Description

@gfs

Currently you can add conditions on a rule, and rules can contain multiple patterns. However, individual patterns may have different conditions. To match them properly now this means necessitating creating multiple rules, each with fewer patterns so that the appropriate conditions can apply.

It would be convenient to be able to also add conditions on individual patterns, to allow for larger more comprehensive rules for a single detection.

One limitation currently is that conditions are all ANDed, all conditions must pass. However, there are some rules like AI040600 where the broad search can apply widely, but conditions to narrow down more specifically are more closely tied to a specific language. It would be nice to have a way to specify what languages a condition does - or does not - apply to.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions