Skip to content

Expand Condition Functionality #524

Open
@gfs

Description

@gfs

Currently you can add conditions on a rule, and rules can contain multiple patterns. However, individual patterns may have different conditions. To match them properly now this means necessitating creating multiple rules, each with fewer patterns so that the appropriate conditions can apply.

It would be convenient to be able to also add conditions on individual patterns, to allow for larger more comprehensive rules for a single detection.

One limitation currently is that conditions are all ANDed, all conditions must pass. However, there are some rules like AI040600 where the broad search can apply widely, but conditions to narrow down more specifically are more closely tied to a specific language. It would be nice to have a way to specify what languages a condition does - or does not - apply to.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions