Hello,
I wrote a successful decoder and some rules that have matches and descriptions. But I want to also be able to print out the srcip, srcport, dstip, dstport, and extra_data information that was originally pulled from the decoder and sent to my email. My current rule as follows: <rule id="100001" level="9"> <if_sid>100000</if_sid> <match>^somestring</match> <description>some description, can i pass variables from decoer to here? $srcip or %%srcip?</description> <options>alert_by_email</options> </rule>
