[Snort-sigs] And-ing content

Chris Green cmg at ...435...
Wed Jun 12 11:18:13 EDT 2002


Erik Fichtner <emf at ...4...> writes:
>
> Now if we only had a NOT in the same rule,

content: "a"; content: !"b";

> or some way to decide to alert or pass based on the result of
> multiple rules.  ;)

Can't help you there right now.
-- 
Chris Green <cmg at ...435...>
To err is human, to moo bovine.




More information about the Snort-sigs mailing list