I don't think you can ignore any rule. So I want to suggest workaround : If both rules will be applied, final score will be 0.26 (RULE 1 + RULE 2). If you don't want the score 0.26, you should change the score of RULE 2 to 0.24 so that your final score will remain 0.25.
-Swati R On Tue, Apr 10, 2012 at 2:44 PM, Tom Kinghorn <[email protected]>wrote: > Morning list > > I was wondering if it is possible to achieve the following: > > > 1. create a meta rule to match 2 items. > 2. assign a score to the test > 3. BUT if a 3rd item is matched, ignore the first score and assign the > higher score > > > EG: > > *RULE 1* > > body __PRIVACY_POLICY /Privacy Policy/ > body __DEAR_CUSTOMER /(Dear Customer|Dear Valued Customer)/i > meta BODY_RULE (__PRIVACY_POLICY && __DEAR_CUSTOMER) > score BODY_RULE 0.01 > > > THEN > > *RULE 2* > > header __HEADER_PVT_1 Received=~ /from > \[192\.168\.[0-9]{1,3}\.[0-9]{1,3}\] \(unknown / > > meta HDR_AND_BODY (BODY_RULE && __HEADER_PVT_1) > score HDR_AND_BODY 0.25 > > > SO THAT > if the 1st 2 conditions are met, then score 0.01 (RULE 1) BUT if the 3 > conditions are met, then score 0.25 (RULE 2) AND NOT 0.01 (RULE 1) > > Is this possible? > > thanks > Tom > > >
