Hi Risto, Is it possible to use global variables? For example: VARIABLE1 = msg 1 VARIABLE2 = msg 2
and after use these variables in a different rules: type=Single ptype=RegExp pattern=sshd\[\d+\]: Failed .+ for (\S+) from ([\d.]+) port \d+ ssh2 desc=use of VARIABLE1 action=logonly $1 $VARIABLE1 type=Single ptype=RegExp pattern=sshd\[\d+\]: Failed .+ for (\S+) from ([\d.]+) port \d+ ssh2 desc=use of VARIABLE2 action=logonly $1 $VARIABLE2 Thanks you!
_______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
