Christian Folini
Christian Folini
Hold on, can we talk this through before we change the policy here? I am the 3 detection rules getting the tag is important. But most of the other rules...
I agree with you mostly. But then the PR should include tagging the skipping rules too. And the change is so big I think it could do with discussing it...
Added this to the agenda for Monday.
So we agreed to implement this at the last [meeting](https://github.com/coreruleset/coreruleset/issues/3529#issuecomment-1953121055). I removed the do-not-merge label an will now merge. Thanks for the PR @azurit.
Yes, please do so. I should have waited. Sorry.
See comment https://github.com/coreruleset/coreruleset/pull/3485#issuecomment-1891501715
We may need to look into this. Thanks for sharing @MirkoDziadzka. What is your take on this @theseion? Do we have options to add context in neighboring rules?
I agree on the removal from PL1, but I think we need to catch the naked keyword `powershell` at higher levels. If there is no rule where it fits, then...
This is a good idea, but it's a slippery road that leads to evasions very quickly. What you have in the chained rule is the MATCHED_VAR, yet the first rule...
@franbuehler What is your take on the seeming lack of `ctl:ruleRemoveById` on the Azure platform?