<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;" bgcolor="#ffffff" text="#000000" link="#686868" vlink="#000000"><div>On Wed, 2020-04-29 at 12:46 +0200, Vincenzo wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div dir="ltr">Hi everyone, in Zeek's signature framework, is it possible to set multiple payloads in "AND" and not in "OR" within a signature?<br>Example<br>my-first-sig signature {<br> ip-proto == tcp<br> dst-port == 80<br> payload /.*root/<br> payload / Hello /<br><br> event "Found root!"<br>}<br><br>From the tests carried out it seems that the two payloads are in 'OR' and not in 'AND' conditions, do you have any suggestions?<br>Thank you<br></div>
<pre>_______________________________________________</pre><pre>Zeek mailing list</pre><pre><a href="mailto:zeek@zeek.org">zeek@zeek.org</a></pre><pre><a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></pre></blockquote><div><br></div><div>Not that I found. Have to make two separate sigs.</div><div><br></div><div>James</div></body></html>