[ossec-list] Re: rule help

[Dave S]

I agree with Ash's second option, use <match>Services|Enum|BITS</
match>
instead of two <match> tags.