You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The arg matching for a rule only allows for extracting an explicit list of values.
However, some rules might have variable argument lists. For example, command <command name> <args>.
It would be helpful, if I could specify a matcher to the remaining arg values:
args:
- cmd
- cmdArgs+
with cmdArgs being set to the remaining line after the matches are extracted.
For example, command nc google.com 443, would resolve to: cmd=nc and cmdArgs="google.com 443"
The text was updated successfully, but these errors were encountered:
I agree that this type of functionality would be useful. Until someone has the opportunity to implement this, you could potentially use optional arguments that is documented here until this type of functionality is added. The aforementioned recommendation wouldn't solve all scenarios but could solve common options.
The arg matching for a rule only allows for extracting an explicit list of values.
However, some rules might have variable argument lists. For example,
command <command name> <args>
.It would be helpful, if I could specify a matcher to the remaining arg values:
with
cmdArgs
being set to the remaining line after the matches are extracted.For example,
command nc google.com 443
, would resolve to:cmd=nc
andcmdArgs="google.com 443"
The text was updated successfully, but these errors were encountered: