On Mon, 24 Oct 2016, SimpleRezo wrote:
So, to the OP: try the tagmatch plugin to look at where _AWLMEAN_ is
(e.g.) <= -1 and _AWLCOUNT_ is greater than (e.g.) 10 and that may get you
what you want for a meta to use with the rules you want to control.
Thank you Paul & John, it looks like I will be able to achieve what I want
with tagmatch & _AWL* tags !
Paul, will be awesome to be able to do gt/lt (of course for now I can deal
with regexp to achieve this)
Paul:
I haven't looked at the plugin myself yet, but here's a suggestion: have a
mode where you can mark a RE as capturing a numeric value, and the rule's
hit value is the value that the RE captured. This would (for example) let
the AWL/TXREP mean be captured in a way it could be compared using gt/lt
in a meta. Perhaps:
tagcapnum __TXREP_IP_MEAN _TXREP_IP_MEAN_ /^(-?[\d]+(?:\.\d+)?)$/
meta TAGMATCH_TXREP_IP_HIGHSCORE __TXREP_IP_MEAN > 5.0
describe TAGMATCH_TXREP_IP_HIGHSCORE TXRep mean score quite large
score TAGMATCH_TXREP_IP_HIGHSCORE 0.1
(...this sort of thing might be really useful as a general purpose rule
type in base SA too...)
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
When designing software, any time you think to yourself "a user
would never be stupid enough to do *that*", you're wrong.
-----------------------------------------------------------------------
307 days since the first successful real return to launch site (SpaceX)
