Condition with External Threat Feed Sources

[Walcrix]

Hello,

I have a question concerning External Threat Feed Sources on HAT.

If I create a new Sender Group for example with IP 1.2.3.4. With also SBRS -10 to -5. And also an ETF configured on this Sender group.

Do Sender Group AND SBRS AND ETF have to match for the stream to pass through this sender group?

Or maybe if ETF match it's always droped ?

Regards,

[Ken Stieers]

No, its inclusive, only has to match one, and it matches against Sender Group from top down, whichever one matches first.