Add new tag rule: multiple values in field

[lacak-sk]

Can I type multiple values in field value (may be separated by comma or semicolon) in conjunction with "exists" (or "is") operator?
I would like type something like: "Destination user:" + "exists" + "user1, user2, user3" iow condition where user matches any value in given list.

(documentation at https://docs.utmstack.com/UTMStackComponents/Threat%20Management/FalsePositive.html does not describe operators in details ...)

[c3s4rfred]

Hi, @lacak-sk the next image shows the possible fields that you can use for tagging rules:

The conditions are very intuitive, but we will take note to explain more in the documentation:

The values must be specific, we don't have REGEXP at the moment for that part of the system.

Best regards

[lacak-sk]

Thanks, but how does works operators "is" and "exists". Is "is" same as "equal" (==)? and "exists" can be used with list of values?
In your example can I somehow set rule: Destination user is (one of) "mike", "john", "joe" (like in SQL: "Destination user" IN ('mike','john','joe'))?

Are these tagging rules somewhere stored in json/yaml files so I can edit them? Now rules can not be edited/altered once they are set (only deleted)?

[c3s4rfred]

The 'is' is similar to equal in this case, 'exists' means that the field exists and don't need to specify a value. For now the we don't have a contain for a list.
The tagging rules aren't stored, are speific for each client data.