Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

expose rule's meta data to other rule #1448

Closed
virusdefender opened this issue Feb 16, 2021 · 1 comment
Closed

expose rule's meta data to other rule #1448

virusdefender opened this issue Feb 16, 2021 · 1 comment

Comments

@virusdefender
Copy link
Contributor

virusdefender commented Feb 16, 2021

private rule Rule1
{
    meta:
        score = 20
    strings:
        $a = "dummy1"
    condition:
        $a
}

private rule Rule2
{
    meta:
        score = 70
    strings:
        $a = "dummy2"
    condition:
        $a
}

private rule Rule3
{
    meta:
        score = 60
    strings:
        $a = "dummy3"
    condition:
        $a
}

rule Rule
{
    condition:
        math.tonumber(Rule1) *Rule1.score + math.tonumber(Rule2) *Rule2.score + math.tonumber(Rule3) *Rule3.score > 85
}

we can avoid hard coding the score value in the final rule if the meta value can be used here, or it should be math.tonumber(Rule1) * 20 + math.tonumber(Rule2) * 70 + math.tonumber(Rule3) * 60 > 85

@virusdefender
Copy link
Contributor Author

the semantics of RuleX is a little strange, it can be a bool or struct, i will re-open this issue if i have a better idea

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant