On 12/3/2022 8:40 μ.μ., Matus UHLAR - fantomas wrote:
this is because PDS_FROM_2_EMAILS has some exceptions, which is why I
advised you to use something different.
Sorry Matus if I don't understand right, but can you please clarify:
The rule:
L_OLEMACRO_ZIP_PW && __PDS_FROM_2_EMAILS
doesn't also depend on the original
PDS_FROM_2_EMAILS
rule? How will this extend the scope of the detected mails? I understand
that the original rule must get triggerred for the whole to get
triggered too. No?
And, when you mentioned:
T_PDS_FROM_2_EMAILS
this was a spelling mistake which meant to be: __PDS_FROM_2_EMAILS or
something I don't understand?
Probably some things are very clear to you as an expert, but I am
missing pieces of the puzzle.
Can you please break things down a bit?
Thanks for all your kind assistance.
Nick
