Forum Discussion
Help with persist command
I need some help with the persist command. It's been a long day so I'm probably not thinking straight anymore.
I have an IP address and a string and when I find the same string in anoth...
Are you asking to persist on both the IP address and the string together?
If so, simply use UIE persistence and concatenate the two together like so:
rule my_uie {
when HTTP_REQUEST {
persist uie [concat [IP::remote_addr] [HTTP::header "MyHeader"]]
}
}
