> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Wednesday, March 17, 2004 6:00 PM > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: RE: Multiple occurrances? > > > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > Is it possible to test for multiple occurrances of a word/symbol? > > -----Response----- > Sure, to a point. You can even assign nonlinear scoring, > which is probably > usually appropriate. > > RULE_NAME Score Test > EXAMPLE_XYZ1 0.1 $Subject =~ /\bxyz\b/i > EXAMPLE_XYZ2 0.05 $Subject =~ /(\bxyz\b.*){2}/i > EXAMPLE_XYZ3 0.03 $Subject =~ /(\bxyz\b.*){3}/i > > This ruleset would score as follows: > 123 xyz 456 abc: 0.1 > 123 xyz xyz abc: 0.15 > 123 xyz xyz xyz: 0.18 > xyz xyz xyz xyz: 0.18 (the max) > > For your scoring, set all the rules to 0.1 points each and add an > EXAMPLE_XYZ4 rule > > [EMAIL PROTECTED] 805.964.4554 x902 > Hispanic Business Inc./HireDiversity.com Software Engineer > perl -e"print join er,reverse qq(\n),'l hack',' P','Just anoth'"
Yeah The rule writers have dreamed of such a built in function! However doing this method tends to slow down SA. Also increases the rule hit summary in the header which causes problems for some if too long. We really wanted an eval to return the score from a count. Unfortunetly it seems to be a limitation in perl. :( So yes this method posted here will work. However we fight to find ways around it unless the outcome exceeds the costs. Like Tripwire. Just $.02 --Chirs
