matchsig()

Returns true if the string matches one or more of the patterns in the pattern group, and false if no pattern is matched.

Syntax

matchsig(SIG_GUID, STR_EXPR)
Required Parameters
SIG_GUID
Pattern group GUID. The GUID string must be a valid pattern group identifier. If you specify an invalid pattern group GUID, the query fails.
STR_EXPR
Expression to return the string to be searched. The evaluated value must be a string. If the expression cannot be evaluated or the value is not valid, the function returns false.

Description

For example, if you set pattern "REMOTE_ADDR" and ("fputs" or "fwrite"), filter expression path == "lib.php", rule zb now connect, the command checks whether the REMOTE_ADDR string and the fputs or fwirte string are searched at the same time in the target field value, and then checks whether the path field value matches the lib.php string.

Example of patterns

expr (required)expr2 (optional)rule (required)
Keyword pattern: Primary high-speed detectionBoolean expression: Secondary filteringPattern name
"addextendedproc" and "xp_cmdshell" xp_cmdshell
"REMOTE_ADDR" and ("fputs" or "fwrite")path == "lib.php"zb now_connect