hard20 pts · first answer countsdetection-engineeringsigma

Operator precedence in a Sigma condition

A rule has `condition: selection_a or selection_b and not filter`. An event matches selection_a and also matches filter. Does the rule fire?

A.No, because the filter is always applied to the whole conditionB.No, because Sigma reads conditions strictly left to rightC.Yes, because "and" binds tighter, so the filter only applies to selection_bD.It depends on which block is written first in the file

Discussion 0

Join free to post in the discussion.

Operator precedence in a Sigma condition

Discussion 0

Related questions