search

defenxor / dsiem

Security event correlation engine for ELK stack
GNU General Public License v3.0
435 stars 100 forks source link

Order Independent "AND" for Directives? #429

Open jmmaurio opened 1 year ago

jmmaurio commented 1 year ago

Is it possible to create a directive that is the AND of three rules that is order independent? For example, I would like to trigger when rule A, rule B and rule C are satisfied, but I don't care what order they were received. I realize I could write six separate directives for all possible sequential occurrences (ABC, ACB, BAC, BCA, CAB, CBA), but this is cumbersome.

mmta commented 1 year ago

It's not possible to do that, and yes you probably have to cover all the permutation like that :(