matchsig()
Returns true if the string matches one or more of the patterns in the pattern group, and false if no pattern is matched.
Syntax
matchsig(SIG_GUID, STR_EXPR)
Required Parameter
SIG_GUID
- Pattern group GUID. The GUID string must be a valid pattern group identifier. If you specify an invalid pattern group GUID, the query fails.
STR_EXPR
- Expression to return the string to be searched. The evaluated value must be a string. If the expression cannot be evaluated or the value is not valid, the function returns false.
Description
For example, if you set pattern "REMOTE_ADDR" and ("fputs" or "fwrite")
, filter expression path == "lib.php"
, rule zb now connect
, the command checks whether the REMOTE_ADDR
string and the fputs
or fwirte
string are searched at the same time in the target field value, and then checks whether the path field value matches the lib.php
string.
Example of patterns
expr (required) | expr2 (optional) | rule (required) |
---|---|---|
Keyword pattern: Primary high-speed detection | Boolean expression: Secondary filtering | Pattern name |
"addextendedproc" and "xp_cmdshell" | xp_cmdshell | |
"REMOTE_ADDR" and ("fputs" or "fwrite") | path == "lib.php" | zb now_connect |