Currently the search_string for filtered_header_rules must have the same value as the rule name. If the search string is a header value that is sensitive, the only way with the existing module to add it as the search string, is to use the name of the rule. I don't believe having the same value for rule name and and search string makes sense in most cases.
This change preserves the previous behaviour, but allows user to set their own search_string.
rpdelaney
commented
1 year ago
Currently the
search_stringforfiltered_header_rulesmust have the same value as the rule name. If the search string is a header value that is sensitive, the only way with the existing module to add it as the search string, is to use the name of the rule. I don't believe having the same value for rule name and and search string makes sense in most cases. This change preserves the previous behaviour, but allows user to set their own search_string.