IPS Event Action Filters - Adding variables to the Attacker/Victim Fields

[rmeans]

Regarding Event Action Filters. How do you add multiple event variables to the attacker and victim fields? I use a comma to separate IP addresses (10.10.1.1,192.168.1.1). When I use a variable ($inside) I have not been able to add any other IP addresses or variables ($dmz) in the same filter rule. Is it possible to have two variables in the same attacker/victim fields? I would have thought $inside,$dmz might work but I get an error. I have also tried $inside\,$dmz and $inside ,$dmz and $inside \,$dmz but get errors saying system variable not found.

[marcabal · Accepted solution]

Only one variable is currently allowed in a field.

There is an enhancement request to support multiple variables in a field, but this has not been targeted for any specific release yet.

[MARK BAKER]

I was surprised to see this discussion from 2007 when it still appears to be the case in 2013 of only one event variable per field. Is there a specific decade targeted for this enhancement?

Thanks,
Mark