dsiem icon indicating copy to clipboard operation
dsiem copied to clipboard

Order Independent "AND" for Directives?

Open jmmaurio opened this issue 2 years ago • 1 comments

Is it possible to create a directive that is the AND of three rules that is order independent? For example, I would like to trigger when rule A, rule B and rule C are satisfied, but I don't care what order they were received. I realize I could write six separate directives for all possible sequential occurrences (ABC, ACB, BAC, BCA, CAB, CBA), but this is cumbersome.

jmmaurio avatar Nov 23 '22 19:11 jmmaurio

It's not possible to do that, and yes you probably have to cover all the permutation like that :(

mmta avatar Jan 10 '23 13:01 mmta