SourceFire Application-filter - Combining the Filters

[jsteffensen]

Hi

Is it possible to combine appliaction-filter in one single rule?

As for my understanding when selecting more filters, like Application filter Risk "Very High" togehter with "Business relevance "very low" this enables all inspections for both categories - like the Boolean expression OR.

Is it possible to combine different application filters, for example based on Risk "Very High" AND "Business relevance "Very low", so that only applications with both criteria matched is selected?

Or did i miss anything out on this?

Best Regards

Jarle

[ankojha]

Hi,

It actually takes AND of the filter criteria and if it finds match of both, only then that particular rule is hit. In your case, is the rule in question is placed at the top of any rule which might conflict with it ?

Thanks,

Ankita