[ossec-list] Re: Help with rule for Windows agent

[Dave S]

Brings up a good point re. rule-matching logic.

What if there are two child rules, and both have conditions that match
an event....which gets chosen?

Is it arbitrary?